ic-signed-agent
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were identified. All operations, including credential handling and network requests, are consistent with the skill's stated purpose of improving authentication security for the author's services.
- [EXTERNAL_DOWNLOADS]: The skill instructions include commands to download the skill definition from the official immersivecommons.com domain using curl.
- [DATA_EXFILTRATION]: The skill uses the FLOOR10_AGENT_TOKEN to authenticate requests to the vendor's API. This is the intended use of the token and is restricted to the vendor's infrastructure.
- [PROMPT_INJECTION]: The skill includes a recovery mechanism that reads a discovery file (/.well-known/agent-card.json) from the vendor's server to update endpoint schemas.
- Ingestion points: SKILL.md (via instructions) and remote agent-card.json discovery file.
- Boundary markers: None specified for the remote JSON content.
- Capability inventory: The skill generates cryptographic keys locally, performs network requests via fetch or urllib, and persists public key identifiers.
- Sanitization: Not explicitly defined for the remote discovery content.
Audit Metadata