xy-opener
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script,
scripts/atoms-search.py, to perform search operations on its internal knowledge base. This script is used to retrieve tactical 'atoms' or guidelines for content creation. - [EXTERNAL_DOWNLOADS]: The search script performs network requests to
https://api.xyskill.xyzto fetch knowledge data from the vendor's API. This domain is owned by the skill's author and the operation is a core functional requirement. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided content (video scripts) for analysis. The instructions mitigate potential injection risks by guiding the agent to extract specific, limited keywords for search operations rather than passing the full user input into system commands.
Audit Metadata