jev-curl
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the generation and execution of
curlcommands to interact with the TypeSafe Jev HTTP API. The implementation follows security best practices by disabling shell tracing (set +x) and passing sensitive authorization headers via standard input (--header @-) to ensure credentials do not appear in process listings or shell history. - [INDIRECT_PROMPT_INJECTION]: The skill acts as an interface for processing external data through a remote AI model, creating a potential surface for indirect prompt injection.
- Ingestion points: External data is ingested into the
statefield of the API request as defined inSKILL.mdandreferences/http.md. - Boundary markers: The skill uses a structured JSON schema to separate the data (
state), the model's tasks (instructions), and the evaluation rules (criteria). - Capability inventory: The primary capability is executing network requests via the
curlbinary as described inreferences/http.md. - Sanitization: The skill mitigates common injection risks by recommending the use of JSON files or quoted heredocs for data transport, which prevents shell metacharacter interference.
Audit Metadata