person-lookup
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the vendor-owned
orthCLI tool to interact with the Nyne API service for performing person searches. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes potentially untrusted data from an external API results. * Ingestion points: Data retrieved from the
/person/searchendpoint of the Nyne API (referenced in SKILL.md). * Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between the skill's instructions and the potentially untrusted API response content. * Capability inventory: The agent has the capability to execute shell commands via theorthutility. * Sanitization: The skill does not specify any sanitization, validation, or filtering of the content returned by the external API before presenting it to the agent.
Audit Metadata