stream-feeds-migration
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute python3 for the sampling script and to verify environment variables.
- [REMOTE_CODE_EXECUTION]: The skill executes a bundled Python script, fetch_sample.py, which uses only standard libraries to communicate with the Stream API.
- [DATA_EXFILTRATION]: The skill fetches data from api.stream-io-api.com, which is a trusted vendor domain for GetStream, as part of the intended migration sampling process.
- [PROMPT_INJECTION]: The skill ingests raw activity and reaction data from the Stream API for analysis, creating a potential surface for indirect prompt injection. 1. Ingestion points: v3sync-sample.json. 2. Boundary markers: None. 3. Capability inventory: Bash (python3, ls, getstream), Read, Glob, Grep. 4. Sanitization: None. The risk is minimized by the trusted source and analytical purpose.
Audit Metadata