name-availability
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
check-domains.shscript fetches the official Top-Level Domain (TLD) list from IANA (data.iana.org) to ensure registration checks are only performed on valid, delegated extensions. This is a trusted source for domain metadata. - [COMMAND_EXECUTION]: The skill utilizes standard system utilities including
curl,dig, andwhoisto perform registration lookups. These tools are executed as subprocesses using double-quoted variables and proper job control, preventing command injection from user-supplied brand names. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted registration data and trademark search results from external sources.
- Ingestion points: Registration records from
whois,dig, andrdap.orgare ingested and processed by the agent. - Boundary markers: The instructions guide the agent to present findings in a structured table format, which helps maintain context and reduces the risk of the agent following instructions embedded in registration records.
- Capability inventory: Capabilities are limited to network-based name lookups and local DNS queries.
- Sanitization: Brand names are URL-encoded in
tm-links.shusing a robusturlencfunction, and shell variables incheck-domains.share properly quoted to ensure data is treated as strings rather than code.
Audit Metadata