waveinflu-discover-creators
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses a multi-layered execution model where the AI agent invokes a local Node.js script (
discover-bounded.mjs) which in turn spawns an atomic script (discover.mjs). This architecture provides strict input validation and boundary enforcement outside the LLM context. - [SAFE]: Data handling follows best practices. Credential management (
credentials.mjs) retrieves keys from standard, restricted-permission configuration directories and explicitly forbids the agent from requesting or displaying these keys in chat. - [SAFE]: All network operations target
api.wavely.cc, which is the official API endpoint for the WaveInflu vendor. The scripts include protections against large responses, timeouts, and redirects to prevent resource exhaustion or data exfiltration. - [SAFE]: The skill implements a 'bounded continuation' logic to prevent unintended credit consumption. It calculates quotas locally, enforces a maximum call limit, and requires user confirmation for cap increases.
- [SAFE]: Input sanitization is comprehensive, using allowlists for platforms, regions, and filters, and canonicalizing URLs to prevent command injection or URL manipulation attacks.
Audit Metadata