rico-resource-article
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources during the candidate collection phase to extract project metrics.
- Ingestion points: The agent is instructed to visit and read content from external GitHub pages, NPM package pages, and official project websites (Step 1).
- Boundary markers: No explicit boundary markers or instructions to ignore embedded commands within the fetched data are defined.
- Capability inventory: The skill possesses the capability to perform network requests to external APIs and write multiple files to the local file system (Steps 3 and 4).
- Sanitization: The instructions do not specify any sanitization, validation, or filtering of the text content fetched from external sites before it is interpolated into the article generation prompt.
- [CREDENTIALS_UNSAFE]: The skill instructions direct the agent to access and manage sensitive configuration paths.
- Evidence: The skill explicitly searches for and creates .env files in the user's home directory (~/.rico-skills/.env) to store API keys for screenshot services. While managing secrets in .env files is a standard convention, the automated access and creation of configuration files in the home directory by an AI agent increases the potential surface for credential exposure.
- [COMMAND_EXECUTION]: The workflow involves automated network operations to interface with third-party screenshot services, such as ScreenshotOne and urlscan.io, and requires fetching metadata from various external web platforms.
Audit Metadata