studio-libraries
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a central library index and specific documentation files from
hub.joyco.studiousingcurl. These operations target the vendor's own infrastructure to provide up-to-date implementation guidelines. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data (markdown and HTML content) from the library index and documentation to shape the agent's architecture and coding decisions.
- Ingestion points: Data enters the agent's context via
curlresponses fromhub.joyco.studio(SKILL.md, steps 1 and 3). - Boundary markers: The instructions do not specify delimiters or explicit instructions to ignore embedded commands within the fetched documentation.
- Capability inventory: The agent has the capability to perform network requests (
curl), write files, and execute package management commands (npm,pip, etc.) based on the ingested content. - Sanitization: There is no mention of sanitizing or filtering the fetched external content before it is used to influence the agent's planning phase.
Audit Metadata