kuikly-network-and-json
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides methods to fetch and parse data from remote URLs, creating an attack surface for instructions embedded in external content.
- Ingestion points:
NetworkModule.requestGet,NetworkModule.requestPost, andNetworkModule.httpRequestdefined inreferences/NETWORK_API_REFERENCE.md. - Boundary markers: Absent. The skill does not provide instructions for the agent to treat remote responses solely as data.
- Capability inventory: Full HTTP networking capabilities and JSON object manipulation tools.
- Sanitization: The provided JSON methods (e.g.,
optString) handle parsing safety but do not provide semantic sanitization against malicious instructions embedded in strings. - [DATA_EXFILTRATION]: The
NetworkModuleprovides generic HTTP request capabilities which can be used to send data to arbitrary external URLs. While this is the intended functionality of the skill, it represents a risk if the agent is tricked into sending sensitive local information to a third-party server. - [COMMAND_EXECUTION]: The skill provides the agent with instructions on how to invoke specific framework methods within the Kuikly ecosystem to perform networking and serialization tasks.
Audit Metadata