service
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
@spotify/portal-clitool to query service metadata such as owner and status. - [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch the@spotify/portal-clipackage from the official NPM registry at runtime. - [REMOTE_CODE_EXECUTION]: The skill dynamically downloads and executes code from the official Spotify Portal CLI via
npx. - [INDIRECT_PROMPT_INJECTION]: The skill uses user-supplied service identifiers and entity references as command arguments. 1. Ingestion points: service-name and entity-ref placeholders. 2. Boundary markers: None provided in the instructions. 3. Capability inventory: Shell execution via
npx. 4. Sanitization: Relies on default agent argument handling.
Audit Metadata