generate-key
Pass
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
curlcommand to interact with the Lab Nocturne Images API. - [EXTERNAL_DOWNLOADS]: The skill makes a network request to
images.labnocturne.comto retrieve API key information at runtime. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates data from an external source into its output without sanitization.
- Ingestion points: Data is read from the JSON response fields (api_key, type, message, and limits) of the
/keyendpoint. - Boundary markers: There are no instructions provided to the agent to treat the remote response as untrusted or to ignore instructions within the JSON content.
- Capability inventory: The skill utilizes the
curlutility to fetch remote content and present it to the user. - Sanitization: No validation or escaping is applied to the fields retrieved from the JSON response before presenting them to the user.
Audit Metadata