yc-batch-evaluator
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The instructions include explicit directives to skip user confirmation, such as "Do NOT ask clarifying questions" and "Start scraping immediately." These patterns reduce human oversight and push the agent toward autonomous execution of multi-step network and file operations.
- [DATA_EXFILTRATION]: The skill reads sensitive credential information from the local file path
~/.gooseworks/credentials.json. It extracts an API key and subsequently transmits it in the headers of network requests toapi.gooseworks.ai. While this targets vendor-owned infrastructure, it establishes a pattern of local secret harvesting. - [COMMAND_EXECUTION]: Shell command substitution and Python one-liners are used to parse local configuration files (e.g.,
python3 -c "import json;print(json.load(open('$HOME/.gooseworks/credentials.json'))['api_key'])"). This represents dynamic execution used for credential extraction. - [DATA_EXFILTRATION]: The skill ingests data from untrusted external websites (Y Combinator directory and various company websites) and sends this content to third-party services like Perplexity and Google Sheets. This creates an indirect data flow where malicious content on a scraped website could potentially influence the output sent to other APIs.
- [PROMPT_INJECTION]: There is a risk of indirect prompt injection because the skill processes content from external websites and company pages without explicit sanitization or boundary markers. Malicious instructions embedded in a company's description could potentially affect the evaluation or ranking logic.
Audit Metadata