intervals-icu
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a shell script (
scripts/api.sh) to perform API calls viacurlandjq. The script handles arguments safely and usesset -euo pipefailto ensure robust execution. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the Intervals.icu API, which could potentially contain instructions intended to influence the agent.
- Ingestion points: Training data (activities, wellness, events) is fetched from the Intervals.icu API endpoints in
scripts/api.sh. - Boundary markers: There are no specific instructions or delimiters provided to the agent to distinguish between data and instructions within the API responses.
- Capability inventory: The skill allows reading and writing athlete data to the API and includes examples of local file redirection.
- Sanitization: The script performs JSON structure validation via
jqbut does not sanitize text fields for potential prompt injection patterns.
Audit Metadata