brand-alchemy
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to run a Python script (scripts/domain_checker.py) for domain verification. The script includes a configuration that bypasses SSL certificate verification to avoid potential local environment issues during network requests.\n- [EXTERNAL_DOWNLOADS]: Thedomain_checker.pyscript performs lookups againstrdap.org, a well-known service for domain registration information. This connection is used to verify the availability of suggested brand names.\n- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided brand names and domain strings which are then used as command-line arguments, presenting a potential surface for indirect prompt injection.\n - Ingestion points: Discovery phase responses in
SKILL.md.\n - Boundary markers: The skill does not define specific delimiters or quoting requirements for the domain names in the tool call.\n
- Capability inventory: Execution of
scripts/domain_checker.pyvia theBashtool.\n - Sanitization: The instructions do not include specific steps to escape or validate user-provided strings before they are processed by the shell.
Audit Metadata