goodcase
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches structured data (JSON) from the public API endpoint
https://goodcase.ai/api/public/cases. This is the primary intended function of the skill and uses the official domain of the service described in the documentation. - [COMMAND_EXECUTION]: Uses the
curlutility to perform HTTP GET requests to retrieve case study information. The commands are used for data retrieval only and do not involve piping output to shell interpreters or executing downloaded scripts. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text data (such as prompt descriptions and summaries) from an external source. While the agent is instructed to format this data for the user, there is a theoretical surface for indirect injection if the external site were compromised. However, the instructions provide specific output templates which act as structural boundaries, and the risk is assessed as low given the skill's read-only purpose.
Audit Metadata