configuration-management
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely instructional, providing a framework for software configuration management (SCM) based on SWEBOK standards. It does not include executable scripts, shell commands, or network operations.
- [DATA_EXFILTRATION]: The instructions explicitly include guardrails for credential safety, directing the agent to ensure that secrets and signing keys are kept out of configuration items and version control, adhering to security best practices.
- [INDIRECT_PROMPT_INJECTION]: The skill describes a process for identifying configuration items by reading dependency manifests and lockfiles. While this constitutes a data ingestion surface, the skill focuses on high-level planning and identification rather than automated processing, and the instructions prioritize data integrity and traceability.
- Ingestion points: Dependency manifests and lockfiles (Step 6).
- Boundary markers: The skill does not define specific prompt delimiters but emphasizes deriving data from actual source manifests.
- Capability inventory: The skill does not invoke any file-writing or subprocess capabilities; it acts as a guide for the agent's reasoning.
- Sanitization: Not explicitly mentioned as the skill is methodological.
Audit Metadata