domain-research
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill is designed to assist users with domain name discovery and price comparison. It interacts with the author's own service (cheapest.domains) and well-known third-party providers like Cloudflare for legitimate research purposes.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided project descriptions and external API data, which creates a standard surface for indirect prompt injection.\n
- Ingestion points: User project context (prompts or files) and API responses from cheapest.domains.\n
- Boundary markers: The instructions explicitly command the agent to treat project text and returned content as task data, not as instructions to change its behavior or exfiltrate credentials.\n
- Capability inventory: The skill performs network requests to the service's API via MCP tools or curl and can read local project files authorized by the user.\n
- Sanitization: Instructions provided in the skill mandate that the agent disregard any instructions embedded within the data it processes.\n- [DATA_EXFILTRATION]: The skill sends proposed domain names to the cheapest.domains API for availability and popularity checks. This is the primary function of the skill and is performed on the vendor's own infrastructure without exposing sensitive user files or credentials.\n- [COMMAND_EXECUTION]: The skill suggests the use of curl as a fallback method to interact with its public HTTPS API. This use is restricted to data retrieval from the service's own endpoints.
Audit Metadata