bulk
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs API operations by executing a local script (api-request.sh) through the Bash tool. This script acts as a wrapper for Spotify Ads API v3 calls.\n- [DYNAMIC_EXECUTION]: Instructions include the use of eval $(api --env) to populate the environment with necessary variables such as TOKEN and AD_ACCOUNT_ID. This is a common pattern for CLI-based environment configuration provided by the vendor.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and displays data from the external Spotify Ads API (e.g., campaign and ad set names). This content is displayed in tables and summaries for user selection and confirmation.\n
- Ingestion points: Data retrieved from Spotify Ads API endpoints via api GET calls (SKILL.md).\n
- Boundary markers: None explicitly implemented for entity data display.\n
- Capability inventory: The skill utilizes the Bash tool for API interaction and AskUserQuestion for user selection and confirmation.\n
- Sanitization: The instructions do not specify sanitization for entity names retrieved from the API before presentation to the user.
Audit Metadata