stats
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to
contextstellar.comto retrieve scoring and learning progress metrics. This network communication is consistent with the skill's primary purpose and uses the vendor's official domain. - [COMMAND_EXECUTION]: Shell commands are executed via
curlto fetch JSON data from the ContextStellar API. These commands are parameterized using environment variables (CONTEXTSTELLAR_API_KEY,CONTEXTSTELLAR_PROJECT_ID) for secure identification and authentication. - [INDIRECT_PROMPT_INJECTION]: The skill processes and displays external data retrieved from API responses, creating a surface for potential instruction injection.
- Ingestion points: Data fetched from
contextstellar.com/api/v1/hooks/shell-statsand/api/v1/hooks/stats(SKILL.md). - Boundary markers: None identified in the output presentation.
- Capability inventory: Uses
curlfor HTTP GET requests (SKILL.md). - Sanitization: No explicit sanitization or filtering of the API response data is implemented before display.
Audit Metadata