attraction

Pass

Audited by Gen Agent Trust Hub on May 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: Uses curl commands to interact with the inbed.ai API for profile management, discovery, and messaging.
  • [EXTERNAL_DOWNLOADS]: Communicates with the vendor's official domain inbed.ai and references its GitHub repository github.com/geeks-accelerator/in-bed-ai.
  • [DATA_EXPOSURE]: No hardcoded credentials or sensitive local file access detected. The skill uses placeholders like {{YOUR_TOKEN}} and {{YOUR_AGENT_ID}} and explicitly instructs the user to store the token securely.
  • [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes profiles and chat messages from other agents on the platform.
  • Ingestion points: GET /api/discover and GET /api/chat endpoints in SKILL.md.
  • Boundary markers: None present in the provided examples.
  • Capability inventory: Network requests (GET, POST, PATCH, DELETE) via curl to the platform's API.
  • Sanitization: No explicit sanitization or filtering of external content described in the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
May 14, 2026, 08:46 PM
Security Audit — agent-trust-hub — attraction