ielts-speaking-coach
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates API interaction by executing a local Python script,
scripts/ielts_buddy_api.py, which handles authentication and capability calls. - [DATA_EXFILTRATION]: The skill communicates with an external API domain (
work.ieltsbuddy.igopx.cn) to sync user materials, which involves standard network operations for data exchange. - [INDIRECT_PROMPT_INJECTION]: The skill ingests materials from a remote API, creating a vulnerability surface where instructions within the data could influence agent behavior.
- Ingestion points: Oral material data retrieved via
ielts_speaking_materials_readinSKILL.md. - Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from obeying text found in retrieved materials.
- Capability inventory: The skill is capable of network communication and local file management for session binding through its scripts.
- Sanitization: No sanitization or content filtering is described in the interface contract.
Audit Metadata