name-availability

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The check-domains.sh script fetches the official Top-Level Domain (TLD) list from IANA (data.iana.org) to ensure registration checks are only performed on valid, delegated extensions. This is a trusted source for domain metadata.
  • [COMMAND_EXECUTION]: The skill utilizes standard system utilities including curl, dig, and whois to perform registration lookups. These tools are executed as subprocesses using double-quoted variables and proper job control, preventing command injection from user-supplied brand names.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted registration data and trademark search results from external sources.
  • Ingestion points: Registration records from whois, dig, and rdap.org are ingested and processed by the agent.
  • Boundary markers: The instructions guide the agent to present findings in a structured table format, which helps maintain context and reduces the risk of the agent following instructions embedded in registration records.
  • Capability inventory: Capabilities are limited to network-based name lookups and local DNS queries.
  • Sanitization: Brand names are URL-encoded in tm-links.sh using a robust urlenc function, and shell variables in check-domains.sh are properly quoted to ensure data is treated as strings rather than code.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 07:03 AM
Security Audit — agent-trust-hub — name-availability