music-industry-research
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill performs network requests using
curltorecoup-api.vercel.appanddevelopers.recoupable.com. These operations target the vendor's own infrastructure and are consistent with the skill's stated purpose. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by ingesting untrusted data from external sources. \n
- Ingestion points: Data enters the agent context through endpoints like
POST /research/extract,POST /research/web,POST /research/enrich, andPOST /research/deepas described inSKILL.mdandreferences/endpoints.md. \n - Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat this external content as untrusted or to ignore embedded instructions. \n
- Capability inventory: The agent has the capability to perform numerous API calls via
curland is instructed to save research results to the file system (e.g.,research/directory inreferences/workflows.md). \n - Sanitization: No sanitization or filtering of the ingested external content is mentioned before it is processed by the agent.
Audit Metadata