companion

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches curriculum data from agency-lab.glebkalinin.com to provide course-specific guidance. This domain is managed by the developer (Gleb Kalinin) and is used for official curriculum content.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external JSON data from a curriculum API which represents a potential injection surface. However, the instructions explicitly command the agent to treat this as data, validate it, and present any suggested actions or commands to the user for review before execution.
  • [SAFE]: The skill demonstrates security best practices by including clear boundaries for data storage, advising against the storage of sensitive credentials, and requiring user confirmation before writing to files or modifying project instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 03:40 PM