producthunt
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the Product Hunt API, such as product descriptions and user comments, which could be used for indirect prompt injection. \n
- Ingestion points: Data enters the agent context via GraphQL query responses fetched in
SKILL.md. \n - Boundary markers: There are no specific delimiters or instructions provided to the agent to ignore potentially malicious content embedded in the API responses. \n
- Capability inventory: The skill uses
curlfor network requests and instructs the agent to useweb_searchfor discovery. \n - Sanitization: No sanitization or filtering of the external API content is performed before interpolation into the agent's context. \n- [EXTERNAL_DOWNLOADS]: Communicates with the official Product Hunt GraphQL API at
api.producthunt.comto retrieve product information. This is a well-known service required for the skill's operation.
Audit Metadata