koog
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The framework includes an
ExecuteShellCommandToolfor running system commands. It provides aConfirmationHandlersystem to regulate execution, including an auto-approval mode ('BraveMode') which is explicitly documented as dangerous, and a safe interactive mode. - [DATA_EXFILTRATION]: The skill provides file management tools (
ReadFileTool,WriteFileTool,ListDirectoryTool) for local file system interaction. Access is managed through aFileSystemProviderinterface, allowing developers to implement least-privilege access, such as read-only filesystem views. Combined with network-capable LLM provider clients, this defines a potential data exfiltration surface. - [INDIRECT_PROMPT_INJECTION]: As a tool-calling agent framework, it possesses an attack surface for indirect prompt injection via tool outputs or external data. The framework ingests untrusted data through tool results (e.g., ReadFileTool) and agent inputs. It offers structured output configurations and a Prompt DSL to help isolate and validate external data processing.
- [DYNAMIC_EXECUTION]: The framework supports dynamic behavior through custom strategy nodes and shell command execution, which are documented as core features for agentic autonomy.
Audit Metadata