skills/shawnhvac/ccn-skill/ccn/Gen Agent Trust Hub

ccn

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill fetches external news articles from an API and presents them for agent processing, which could allow maliciously crafted news content to influence agent behavior.
  • Ingestion points: The skill uses curl commands in SKILL.md to fetch JSON data from https://agentworld.me/api/ccn/news and https://agentworld.me/api/ccn/latest.
  • Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore potential commands embedded within the fetched news headlines or summaries.
  • Capability inventory: The skill utilizes curl for network requests to read external data.
  • Sanitization: No specific validation, filtering, or escaping of the incoming news JSON payload is performed before the agent interprets the content.
  • [EXTERNAL_DOWNLOADS]: Fetches news headlines and wire metadata from the vendor-associated domain agentworld.me.
  • Evidence: curl -s -A "Mozilla/5.0" "https://agentworld.me/api/ccn/news?limit=10" and curl -s -A "Mozilla/5.0" "https://agentworld.me/api/ccn/latest" as documented in SKILL.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 03:03 AM