frontpage-vote

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill's installation instructions use npx skills add to fetch content from the GitHub repository DFectuoso/frontpage-sh-skills. This is a standard installation mechanism for the platform.
  • [COMMAND_EXECUTION]: The documentation includes executable command examples using curl, npx, and the mppx CLI tool for interacting with the API and performing payments.
  • [PROMPT_INJECTION]: The skill processes untrusted user-generated content retrieved from https://www.frontpage.sh/api/proposals, which includes fields like title, body, and suggesterName that could contain malicious instructions.
  • Ingestion points: Data enters the agent's context through the /api/proposals endpoint described in SKILL.md.
  • Boundary markers: There are no explicit instructions or delimiters defined to separate user-submitted content from the agent's own instructional context.
  • Capability inventory: The skill has the capability to perform network POST requests (/api/votes, /api/proposals/submit, /api/comments) that trigger on-chain financial transactions ($0.01 USDC).
  • Sanitization: No specific text sanitization or verification of the external idea content is documented before the agent processes it.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 02:50 AM
Security Audit — agent-trust-hub — frontpage-vote