viralquery
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were detected in the skill instructions or configuration.
- [CREDENTIALS_UNSAFE]: The skill adheres to best practices for secret management by instructing the agent to read the API key from a configured environment variable or secret ($VIRALQUERY_API_KEY) and explicitly forbidding its inclusion in chat outputs or source files.
- [EXTERNAL_DOWNLOADS]: Network operations are restricted to the official ViralQuery API domain (api.viralquery.com) for its intended purpose of fetching app and video data.
- [COMMAND_EXECUTION]: No arbitrary command execution or shell interactions were found; the skill relies solely on structured HTTP requests.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes user-supplied app names and App Store links, it instructs the agent to perform extraction of numeric IDs and use JSON formatting, which provides a layer of data sanitization against injection attempts.
Audit Metadata