compute-env-setup
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
callCommandandsubmitJobto interact with remote host environments. These tools are used for non-destructive operations such as probing host capabilities and validating environment activation. The instructions inSKILL.mdexplicitly forbid the agent from performing full package installations or resource deletions directly, requiring those actions to be executed by the user.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, including host command outputs and host knowledge documents. \n - Ingestion points: Data enters the agent context via
compute.callCommandresponses,host.compute.listHosts(), andhost.compute.details()inSKILL.md.\n - Boundary markers: Environment names are restricted to specific characters and lengths; activation files are restricted to the
~/.open-science/environments/directory.\n - Capability inventory: The skill possesses
callCommandandsubmitJob(remote command execution) andhost.compute.details(SKILL.md).\n - Sanitization: Validation is performed by checking for specific witness outputs (e.g., Python executable paths) rather than blindly trusting the environment state.
Audit Metadata