company-funding-search
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands (
curl,python3) to interact with company data APIs and manage local configuration. These operations are limited to the skill's primary functionality. - [DATA_EXFILTRATION]: The skill reads API keys from
~/.gooseworks/credentials.json, which is a vendor-specific configuration file. This is standard practice for managing credentials for a specific toolset and does not involve accessing sensitive user data like SSH keys or system environment variables. - [EXTERNAL_DOWNLOADS]: Network requests are directed to
api.gooseworks.aiandapi.orth.sh. These endpoints correspond to the vendor infrastructure and the documented source of the data. - [PROMPT_INJECTION]: The skill retrieves structured and natural language data from external APIs to answer user queries. While this creates a surface for potential indirect prompt injection from the retrieved content, the risk is minimal as the data originates from the vendor's own search services.
Audit Metadata