troubleshoot
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official vendor domains (sync.so, api.sync.so) and installs verified packages (@sync.so/mcp-server, syncsdk, @sync.so/sdk) that belong to the skill author (synchronicity-labs).
- [CREDENTIALS_UNSAFE]: The skill provides secure guidance for managing API keys using environment variables and warns the agent never to expose or request keys from the user.
- [COMMAND_EXECUTION]: Transparent curl commands are provided for uploading media to vendor-controlled signed URLs, which is expected for the service's functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests job metadata and error text. It mitigates risk by instructing the agent to sanitize feedback and omit sensitive data.
Audit Metadata