music-industry-research

Pass

Audited by Gen Agent Trust Hub on May 10, 2026

Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill performs network requests using curl to recoup-api.vercel.app and developers.recoupable.com. These operations target the vendor's own infrastructure and are consistent with the skill's stated purpose.
  • [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by ingesting untrusted data from external sources. \n
  • Ingestion points: Data enters the agent context through endpoints like POST /research/extract, POST /research/web, POST /research/enrich, and POST /research/deep as described in SKILL.md and references/endpoints.md. \n
  • Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat this external content as untrusted or to ignore embedded instructions. \n
  • Capability inventory: The agent has the capability to perform numerous API calls via curl and is instructed to save research results to the file system (e.g., research/ directory in references/workflows.md). \n
  • Sanitization: No sanitization or filtering of the ingested external content is mentioned before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
May 10, 2026, 09:47 PM