skills/xyaz1313/xyskill/xy-ip/Gen Agent Trust Hub

xy-ip

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions direct the AI agent to execute a local Python script (scripts/atoms-search.py) using python3 to search a knowledge base for case studies and methodology. This is an intended part of the skill's functionality for providing evidence-based positioning advice.
  • [EXTERNAL_DOWNLOADS]: The atoms-search.py script is configured to perform network requests (POST) to https://api.xyskill.xyz/v1/atoms/search. This domain is a vendor-owned resource associated with the author 'xyaz1313' and is used to retrieve data from a cloud-based knowledge repository when local data is unavailable.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from two sources: input provided by the user (descriptions of social media accounts and business ideas) and external data retrieved via the search script. While this creates a vulnerability surface for indirect prompt injection, the risk is mitigated by the skill's rigid diagnostic framework and lack of high-privilege capabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 05:21 AM
Security Audit — agent-trust-hub — xy-ip