xy-mode
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a bundled Python utility
scripts/atoms-search.pyto query its internal knowledge base. - [EXTERNAL_DOWNLOADS]: The included search script communicates with
https://api.xyskill.xyz/v1/atoms/searchto retrieve audit data and case studies. While this matches the vendor's naming context (xyaz1313), it involves network communication to an external endpoint. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze complex, untrusted descriptions of business and commission models provided by the user (SKILL.md, Phase 1 and Phase 2). It lacks explicit boundary markers or delimiters for this ingested content and does not implement specific sanitization or filtering before the data is used to influence the agent's audit logic or the keywords passed to the search script.
Audit Metadata