hadith-search
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves content from a public Hadith API (api.hadith.gading.dev). This external interaction is essential for the skill's documented functionality and does not involve downloading executable scripts or code.
- [COMMAND_EXECUTION]: The skill utilizes curl to perform HTTP GET requests to the API. These commands are statically defined in the instructions and do not facilitate the injection of unvalidated user arguments into the shell.
- [PROMPT_INJECTION]: There is an inherent surface for indirect prompt injection as the skill ingests text from an external provider (Ingestion point: api.hadith.gading.dev). While boundary markers (Boundaries: Absent) and sanitization (Sanitization: Absent) are not mentioned, the risk is mitigated because the ingested text is used only for display to the user and not as input for sensitive tools or system commands (Capability inventory: curl).
Audit Metadata