xy-coach
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell and Python scripts (xy-init.sh, atoms-search.py) to initialize the environment and search knowledge bases.
- [EXTERNAL_DOWNLOADS]: Retrieves external knowledge data ('atoms') from the vendor's API at https://api.xyskill.xyz/v1/atoms/search during runtime.
- [DATA_EXFILTRATION]: Transmits user-derived search queries to the vendor-controlled domain api.xyskill.xyz to perform knowledge retrieval.
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from local archives and remote APIs that could influence agent behavior. 1. Ingestion points: Local files in ~/.xy/ (profiles, sessions) and remote content from api.xyskill.xyz. 2. Boundary markers: None used in the instructions to separate untrusted business data from system logic. 3. Capability inventory: Ability to execute shell commands via bash and Python scripts using subprocesses. 4. Sanitization: No verification or escaping of ingested data was found before it is provided to the agent context.
Audit Metadata