arken-search-deal-types
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs HTTP GET requests to
https://usearken.com/api/v1/deal-typesto retrieve a negotiation catalog. - [DATA_EXFILTRATION]: The skill transmits user-provided search terms to an external domain through the
qquery parameter in thecurlrequest. - [COMMAND_EXECUTION]: The skill instructs the agent to execute the
curlshell command to interact with the external API. - [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from an external API, which presents an attack surface for indirect prompt injection if the API content were to be compromised.
- Ingestion points: The
datafield returned from the API response athttps://usearken.com/api/v1/deal-types. - Boundary markers: No specific delimiters or "ignore instructions" warnings are present to protect the agent from directives embedded in the external data.
- Capability inventory: The skill is restricted to searching and matching data; it does not have the capability to write files, establish persistence, or execute further arbitrary commands based on the ingested content.
- Sanitization: No formal sanitization or validation of the API response data is defined in the instructions.
Audit Metadata