report
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Spotify Ads API requests by calling a local shell script (
api-request.sh). The commands use structured parameters such as entity IDs and metrics, which are clearly defined in the instructions to prevent arbitrary command execution. - [DYNAMIC_EXECUTION]: The skill uses
eval $(api --env)to load session-specific environment variables like API tokens and account IDs. This method is used to securely manage credentials retrieved from a local script without hardcoding them in the skill content. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the Spotify Ads API. While this constitutes ingestion of untrusted external data, the risk is low as the API primarily returns structured numerical metrics and predefined labels. The results are formatted into tables for the user, providing a clear boundary for data presentation.
Audit Metadata