create-artist
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands (
curl,jq,grep) to perform a series of 8 sequential API calls and manage a local checklist file (RECOUP.md). These operations are scoped to the vendor's API and the artist's workspace directory. - [EXTERNAL_DOWNLOADS]: Performs multiple data retrieval operations from
api.recoupable.com, fetching artist profiles, career data, and web search results. This behavior is documented and aligns with the skill's enrichment purpose. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its ingestion of untrusted external data.
- Ingestion points: Web search results (
/api/research/web) and artist profile bios (/api/research/profile) are pulled into the agent's context in Step 4. - Boundary markers: No explicit delimiters are used when synthesizing external data into the final knowledge base report in Step 8.
- Capability inventory: The skill possesses file-write capabilities to the local workspace (
RECOUP.mdand thereleases/directory) and network access to the Recoup API. - Sanitization: There is no specified logic for validating or escaping external content before it is processed by the agent.
Audit Metadata