subgraphs
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the CLI installation script from the official vendor domain (goldsky.com).
- [REMOTE_CODE_EXECUTION]: Provides an installation command that pipes a remote script from the official vendor website directly to the shell (curl | sh).
- [COMMAND_EXECUTION]: Contains numerous commands for the
goldskyCLI to manage subgraphs, including initialization, deployment, log tailing, and webhook management. - [INDIRECT_PROMPT_INJECTION]: The skill describes commands that ingest data from external sources which could potentially contain malicious instructions.
- Ingestion points: The
goldsky subgraph deploycommand inSKILL.mdaccepts data from external URLs (--from-url), IPFS hashes (--from-ipfs-hash), and local ABI files (--from-abi). - Boundary markers: No specific boundary markers or instruction-ignoring warnings are mentioned in the documentation for processed external data.
- Capability inventory: The skill utilizes the
goldskyCLI which has capabilities to write files, perform network operations, and modify subgraph configurations. - Sanitization: No sanitization or validation steps for external content are described in the provided documentation.
Audit Metadata