score-profile
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads profile images from GitHub's official domain (
github.com). This is a well-known service and is used as intended for the skill's primary purpose of profile analysis. - [COMMAND_EXECUTION]: The skill instructs the agent to use
curlfor fetching images andbase64for encoding them. This allows the agent to embed the image directly into an HTML report for offline viewing. This is a routine operation for generating localized content. - [DATA_EXPOSURE_&_EXFILTRATION]: No exfiltration patterns were detected. The network activity is restricted to a trusted vendor (GitHub) and does not involve accessing or transmitting sensitive system files or credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from GitHub profiles and inserts it into an HTML template. While there is a potential attack surface for cross-site scripting (XSS) if profile data contains malicious scripts, the scope is limited to a local file (
file://) and the skill's architecture relies on established analysis tools for input.
Audit Metadata