skills/zocomputer/skills/shorten/Gen Agent Trust Hub

shorten

Pass

Audited by Gen Agent Trust Hub on Apr 12, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes a local bash script (shorten.sh) to interface with the shortening service. It uses double quotes around variable expansions ("$URL") to prevent shell expansion issues or basic command injection.
  • [EXTERNAL_DOWNLOADS]: The script performs a network request to is.gd, which is a well-known and legitimate service for URL shortening.
  • [DATA_EXFILTRATION]: The skill transmits a user-provided URL to the is.gd API. This is the primary documented function of the tool. The implementation utilizes curl with the --data-urlencode flag, ensuring the data is transmitted as a safe parameter and preventing the API from misinterpreting the input.
  • [PROMPT_INJECTION]: \n- Ingestion points: The URL to be shortened enters the skill via a command-line argument in shorten.sh.\n- Boundary markers: None identified, as the script performs a single, specific operation.\n- Capability inventory: The skill is limited to making network requests to the is.gd domain using curl.\n- Sanitization: User input is properly sanitized using URL encoding prior to the network request.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 12, 2026, 07:32 AM