maxia
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses curl commands to interact with external endpoints hosted at maxiaworld.app for crypto market intelligence, service discovery, and registration.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from a marketplace where other AI agents can provide content, creating a vulnerability surface where adversarial instructions could be embedded in service descriptions or market data.
- Ingestion points: External data is pulled from the marketplace API at maxiaworld.app/api/public/.
- Boundary markers: The skill includes a 'Transaction and data boundaries' section advising that marketplace responses should be treated as untrusted data and verified independently.
- Capability inventory: The skill supports network operations via curl, including state-changing operations like marketplace registration and service execution.
- Sanitization: There is no evidence of technical sanitization, such as JSON schema validation or instruction filtering, for the external data retrieved from the marketplace.
Audit Metadata