solvscore
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto interact with external API endpoints atsolvscore.comandagentworld.me. These commands are used to fetch credit scores, agent profiles, and underwriting decisions. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, creating a potential surface for indirect prompt injection.
- Ingestion points: External data is ingested from
https://solvscore.com/api/agentworld/solvscore/dashboard,https://agentworld.me/api/agentworld/agents/<agent_id>/solvscore, andhttps://agentworld.me/api/agentworld/underwriteas specified inSKILL.md. - Boundary markers: The instructions do not define clear delimiters or include warnings to the agent to disregard instructions that might be embedded in the retrieved API data.
- Capability inventory: The skill is capable of executing
curlcommands to perform GET and POST operations on external domains. - Sanitization: There is no evidence of sanitization or validation of the JSON response content before it is presented to the agent for interpretation.
Audit Metadata