linux-at-spi2
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides technical patterns for interacting with the Linux accessibility layer and D-Bus session bus. The implementation includes robust security controls such as validating application names against a blocklist (e.g., 'keepassxc', 'gnome-terminal') and enforcing timeouts on all D-Bus IPC calls to prevent hanging or malicious blocking operations.
- [INDIRECT_PROMPT_INJECTION]: The skill design creates a surface for Indirect Prompt Injection (Category 8) because it ingests data from external application windows.
- Ingestion points: The agent reads UI text content via Atspi.Accessible interfaces in the 'SecureATSPI.get_object_value' method.
- Boundary markers: The instructions lack specific markers or delimiters to help the agent distinguish between UI labels and potential instructions embedded in third-party software.
- Capability inventory: The skill provides capabilities to perform actions ('do_action') and input text ('set_text_safely') into other applications.
- Sanitization: While the skill blocks access to objects with the 'PASSWORD_TEXT' role, it does not perform content-based filtering or sanitization of strings read from standard UI elements to prevent them from influencing the agent's behavior.
Audit Metadata