x2c-real-dashboard
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell scripts in the scripts/ directory to perform data queries. These scripts (e.g., trend.sh, recent-activity.sh) include basic validation for numeric inputs to prevent common command injection or malformed request issues.
- [DATA_EXFILTRATION]: Performs network requests to a Supabase-hosted API at ukbyfmmerxhlghlhbxtz.supabase.co to fetch dashboard data using the X2C_API_KEY. These network operations are necessary for the skill's primary function and target a well-known service infrastructure.
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes data from an external API, which could potentially contain untrusted instructions. * Ingestion points: JSON responses from the X2C API scripts in the scripts/ directory. * Boundary markers: Not present; the agent receives raw JSON output from the shell scripts. * Capability inventory: Subprocess execution of localized shell scripts and network calls via curl. * Sanitization: Not present; the skill outputs raw JSON data for the agent to process.
Audit Metadata