splice-credits-and-pricing
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to retrieve and process external content from
https://splice.film.fun/pricing.jsonandhttps://splice.film.fun/pricing.mdat runtime to obtain current model pricing. - Ingestion points: Pricing data and model lists are fetched from external JSON and Markdown files located on the
splice.film.fundomain. - Boundary markers: There are no instructions or delimiters provided to ensure the agent ignores any potential instructions embedded within the fetched external data.
- Capability inventory: The skill enables the agent to check account balances and initiate payment requests via the Solana Pay integration at the
/api/agents/credits/purchaseendpoint. - Sanitization: The instructions do not define any validation or sanitization steps for the data retrieved from the external URLs before it is incorporated into the agent's context.
- [EXTERNAL_DOWNLOADS]: The skill refers to and fetches data from external endpoints to maintain up-to-date pricing and service information.
- Evidence: The agent is directed to access
https://splice.film.fun/pricing.jsonand interact with the API/MCP server athttps://splice.film.fun/api/mcp.
Audit Metadata