kata-build-jido
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates on external data by reading local Elixir repositories and change requests, which provides a surface for indirect prompt injection.
- Ingestion points: The agent reads repository metadata (
mix.exs), source code, configuration files, and user-provided change requests. - Boundary markers: The instructions mandate selecting the smallest possible surface for changes and advise restricting tool exposure to specific requests.
- Capability inventory: The skill authorizes editing local source, test, and configuration files, as well as executing local build and test commands.
- Sanitization: The agent is explicitly instructed to validate inputs at the action boundary and to treat filesystem, shell, and network tools as high risk.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute build and test commands standard to the Elixir ecosystem.
- Evidence: The agent is authorized to run
mix compile --warnings-as-errorsandmix testto verify changes. - Mitigation: These commands are restricted to local verification of the implementation and are standard practice for software engineering agents.
Audit Metadata