Skills
skills/kudosity/skills/kudosity-contacts-lists/Gen Agent Trust Hub

kudosity-contacts-lists

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute curl commands to interact with the Kudosity (TransmitSMS) API.
  • Evidence: Examples in SKILL.md demonstrate the use of curl for the /add-list.json and /add-to-list.json endpoints.
  • Scope: The commands are targeted at https://api.transmitsms.com, which is a verified vendor domain for Kudosity.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by processing external data for use in CLI parameters.
  • Ingestion points: Contact information (MSISDN, names, custom fields) ingested in Step 2 of SKILL.md to be added to lists.
  • Boundary markers: Absent; user-supplied data is interpolated directly into curl -d strings without explicit delimiter protection.
  • Capability inventory: Shell execution capability via curl as defined in SKILL.md.
  • Sanitization: No explicit sanitization or escaping instructions are provided for the agent when handling user-provided contact details.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 01:03 AM
Security Audit — agent-trust-hub — kudosity-contacts-lists