data-query
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEDATA_EXFILTRATION
Full Analysis
- Data Exposure & Exfiltration (LOW): The skill makes several GET requests to a non-whitelisted external domain (
60s.viki.moe) to fetch exchange rates, lunar calendar info, and other data. While this is the primary purpose of the skill, it represents outbound network activity. - Indirect Prompt Injection (LOW): The skill retrieves and processes natural language content (like encyclopedia summaries and historical event titles) from an external API, creating a surface for injection.
- Ingestion points: API responses from
https://60s.viki.moe/v2are parsed and displayed by the agent (found inSKILL.md). - Boundary markers: Absent; the skill directly prints API responses without delimiters or warnings to ignore embedded instructions.
- Capability inventory: Limited to network read operations (
requests.get); no file-write or command execution capabilities detected. - Sanitization: No sanitization or validation of the text returned by the API is performed before it is processed by the agent.
Audit Metadata