social-content
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute
curlcommands for interacting with external APIs. This functionality is used to source images from Unsplash, monitor trending topics on Reddit, and publish content to social platforms. The usage is transparently documented and restricted to the skill's stated purpose. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to established services including
reddit.com,api.unsplash.com, andengagemate.app. These connections are necessary for gathering content inspiration and publishing posts. The references to these services are documented neutrally and serve the primary functionality of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill features ingestion points for external data from Reddit and X/Twitter to inform content generation. While this exposes a surface for potential injection, the risk is mitigated by the skill's operational design, which explicitly mandates that the agent preview content for the user and obtain manual confirmation before any network write (posting) occurs.
- [CREDENTIALS_UNSAFE]: The skill provides clear instructions for managing sensitive API keys and client secrets through environment variables (e.g.,
REDDIT_CLIENT_ID,UNSPLASH_CLIENT_ID). It appropriately avoids hardcoding secrets and promotes secure development practices for handling authentication tokens.
Audit Metadata