gramio-pick-username
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled JavaScript script (
check-usernames.mjs) using the Node.js runtime. This script is part of the skill's distribution and performs the core logic of validating and checking usernames. - [EXTERNAL_DOWNLOADS]: The availability check involves making HTTP GET requests to the well-known service Telegram (
t.me). These requests are used solely to inspect the public HTML of potential username pages to determine if they are occupied. - [INDIRECT_PROMPT_INJECTION]: The skill takes user-provided topics and audiences as input to generate candidate usernames. These candidates are then passed to a shell command as arguments. The bundled script includes a validation function (
validateUsername) that enforces strict alphanumeric and underscore rules, which effectively sanitizes the input before it is used in network operations.
Audit Metadata