liveavatar-feedback
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits integration summaries and user feedback to the vendor's domain (api.liveavatar.com). This process is transparent, requires explicit user consent, and allows the user to review and edit all data before transmission.- [INDIRECT_PROMPT_INJECTION]: The skill ingests raw user feedback for submission to a remote API, which represents a potential injection surface.
- Ingestion points: User input in the
additional_feedbackfield defined inSKILL.md. - Boundary markers: None present in the
curlpayload construction. - Capability inventory: Network POST request capabilities using
curlas defined inSKILL.md. - Sanitization: Instructions explicitly direct the agent to use the user's exact words verbatim without rephrasing or summarization.
Audit Metadata