canary-watch
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from external URLs, such as page text, console logs, and API responses. This data enters the agent's context and could contain malicious instructions.
- Ingestion points: Target URLs monitored via the
/canary-watchcommand (e.g., inSKILL.md). - Boundary markers: The skill lacks explicit delimiters or instructions to treat monitored web content as untrusted data.
- Capability inventory: The skill uses browser tools, performs network requests, writes to local log files, and triggers system notifications.
- Sanitization: No sanitization or filtering of the external content is described.
- [COMMAND_EXECUTION]: The skill initiates desktop notifications on macOS and Linux, which involves the use of system-level utilities to display alerts to the user.
- [DATA_EXFILTRATION]: The skill can be configured to send alerts to external Slack or Discord webhooks, facilitating the transmission of monitoring data to well-known external communication platforms.
Audit Metadata