skills/xyaz1313/xyskill/xy-mode/Gen Agent Trust Hub

xy-mode

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a bundled Python utility scripts/atoms-search.py to query its internal knowledge base.
  • [EXTERNAL_DOWNLOADS]: The included search script communicates with https://api.xyskill.xyz/v1/atoms/search to retrieve audit data and case studies. While this matches the vendor's naming context (xyaz1313), it involves network communication to an external endpoint.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze complex, untrusted descriptions of business and commission models provided by the user (SKILL.md, Phase 1 and Phase 2). It lacks explicit boundary markers or delimiters for this ingested content and does not implement specific sanitization or filtering before the data is used to influence the agent's audit logic or the keywords passed to the search script.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 05:23 AM
Security Audit — agent-trust-hub — xy-mode