brand-alchemy

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to run a Python script (scripts/domain_checker.py) for domain verification. The script includes a configuration that bypasses SSL certificate verification to avoid potential local environment issues during network requests.\n- [EXTERNAL_DOWNLOADS]: The domain_checker.py script performs lookups against rdap.org, a well-known service for domain registration information. This connection is used to verify the availability of suggested brand names.\n- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided brand names and domain strings which are then used as command-line arguments, presenting a potential surface for indirect prompt injection.\n
  • Ingestion points: Discovery phase responses in SKILL.md.\n
  • Boundary markers: The skill does not define specific delimiters or quoting requirements for the domain names in the tool call.\n
  • Capability inventory: Execution of scripts/domain_checker.py via the Bash tool.\n
  • Sanitization: The instructions do not include specific steps to escape or validate user-provided strings before they are processed by the shell.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:20 PM