jotbird-publish
Fail
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill file contains a hardcoded authentication token (
jb_c57e765852df55f32daa0f8c745b3241552a052ddfbe1907f73a4d67d107fe4b) assigned to theJOTBIRD_API_KEYenvironment variable. Hardcoding secrets in skill instructions is a dangerous practice that can lead to credential theft or unauthorized service usage. - [COMMAND_EXECUTION]: The skill makes extensive use of the
curlcommand-line tool to perform network operations, including sending user-provided content to external endpoints (jotbird.com). - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface where it ingests untrusted Markdown content from users and transmits it to a remote API. While this is the intended functionality, the lack of explicit sanitization or boundary markers for the interpolated content presents a potential path for indirect injection attacks if the downstream service or agent processes the content further.
Recommendations
- AI detected serious security threats
Audit Metadata