release-validation
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external data including test reports, SAST logs, and signed artifacts to determine release readiness. This ingestion of untrusted data represents an indirect prompt injection surface.
- Ingestion points: Instructions in
SKILL.mdrequire the agent to review "third-party reports", "SAST reports", and "absolute log paths". - Boundary markers: The skill incorporates defensive instructions, mandating that the agent rely on "cryptographically verifiable artifacts" and "signed test results" to prevent spoofing or social engineering.
- Capability inventory: The skill acts as a "Gatekeeper" for the production environment, with the capability to influence the deployment pipeline based on its findings.
- Sanitization: While the skill emphasizes verifying the integrity and authenticity of the source artifacts, it does not explicitly detail text-based sanitization for the content of the logs being processed.
Audit Metadata