shorten
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local bash script (
shorten.sh) to interface with the shortening service. It uses double quotes around variable expansions ("$URL") to prevent shell expansion issues or basic command injection. - [EXTERNAL_DOWNLOADS]: The script performs a network request to
is.gd, which is a well-known and legitimate service for URL shortening. - [DATA_EXFILTRATION]: The skill transmits a user-provided URL to the
is.gdAPI. This is the primary documented function of the tool. The implementation utilizescurlwith the--data-urlencodeflag, ensuring the data is transmitted as a safe parameter and preventing the API from misinterpreting the input. - [PROMPT_INJECTION]: \n- Ingestion points: The URL to be shortened enters the skill via a command-line argument in
shorten.sh.\n- Boundary markers: None identified, as the script performs a single, specific operation.\n- Capability inventory: The skill is limited to making network requests to theis.gddomain usingcurl.\n- Sanitization: User input is properly sanitized using URL encoding prior to the network request.
Audit Metadata