frontpage-vote
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's installation instructions use
npx skills addto fetch content from the GitHub repositoryDFectuoso/frontpage-sh-skills. This is a standard installation mechanism for the platform. - [COMMAND_EXECUTION]: The documentation includes executable command examples using
curl,npx, and themppxCLI tool for interacting with the API and performing payments. - [PROMPT_INJECTION]: The skill processes untrusted user-generated content retrieved from
https://www.frontpage.sh/api/proposals, which includes fields liketitle,body, andsuggesterNamethat could contain malicious instructions. - Ingestion points: Data enters the agent's context through the
/api/proposalsendpoint described inSKILL.md. - Boundary markers: There are no explicit instructions or delimiters defined to separate user-submitted content from the agent's own instructional context.
- Capability inventory: The skill has the capability to perform network POST requests (
/api/votes,/api/proposals/submit,/api/comments) that trigger on-chain financial transactions ($0.01 USDC). - Sanitization: No specific text sanitization or verification of the external idea content is documented before the agent processes it.
Audit Metadata