xy-echo-test
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user content for diagnosis and incorporates results retrieved from an external API (api.xyskill.xyz) and local knowledge files. This architecture creates an attack surface for indirect prompt injection if external data sources or user-provided content contain adversarial instructions. 1. Ingestion points: User-provided scripts (Phase 1) and search results from the atoms-search.py script. 2. Boundary markers: The skill does not explicitly instruct the agent to use delimiters or ignore embedded instructions within the processed data. 3. Capability inventory: Execution of a local Python script and network communication via urllib. 4. Sanitization: There is no evidence of input validation or output sanitization for the retrieved knowledge data.
- [EXTERNAL_DOWNLOADS]: The atoms-search.py script performs network requests to https://api.xyskill.xyz/v1/atoms/search to fetch relevant knowledge atoms. This introduces a dependency on external infrastructure provided by the vendor.
- [COMMAND_EXECUTION]: The skill invokes a local script, python3 scripts/atoms-search.py, to handle keyword-based retrieval. While this is an integrated part of the skill's logic, it demonstrates the capability to execute local code.
- [DATA_EXFILTRATION]: The search tool transmits keywords derived from the user's content to the remote API. The search script also programmatically accesses configuration files in the user's home directory (e.g., ~/.xy/config.json) to resolve local knowledge base paths.
Audit Metadata