xy-private-ops
Warn
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses a local Python script
scripts/atoms-search.pyto facilitate knowledge retrieval, which is executed by the agent via shell commands. - [REMOTE_CODE_EXECUTION]: The included search script performs network requests using
urllib.requestto an external API athttps://api.xyskill.xyz. This allows the script to fetch and integrate external data into the agent's session at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests data returned from the external API into the agent's context without sanitization or boundary markers.
- Ingestion points: Output from the
atoms-search.pyscript is interpolated into the agent's response logic. - Boundary markers: None are specified in the instructions to separate external data from system instructions.
- Capability inventory: The agent has shell access to execute Python and the script has network access to fetch data.
- Sanitization: There is no evidence of output validation or escaping for the data retrieved from the remote API.
Audit Metadata