atai-anomaly-discovery-agent
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill facilitates the transfer of sensor data to the vendor's API endpoint (api.u1.archetypeai.app). The implementation correctly utilizes environment variables for API key management, ensuring that sensitive credentials are not hardcoded within the script.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data via CSV files for analysis. 1. Ingestion points:
references/run_ad_agent.pyreads user-supplied sensor data from CSV files. 2. Boundary markers: Not applicable as the input is treated as numeric sensor data for a machine learning detector. 3. Capability inventory:references/run_ad_agent.pyperforms network uploads and local file writes. 4. Sanitization: The script uses standard CSV parsing to process numeric values. The risk is effectively mitigated because the data is used for numeric anomaly detection rather than being interpolated into language model prompts. - [DYNAMIC_EXECUTION]: The test suite in
tests/test_references.pyemploysimportlib.utilto dynamically load the local runner script for verification. This execution is limited to the local file system for testing purposes and does not involve untrusted remote code execution. - [SAFE]: All external domains, endpoints, and support contacts identified in the skill instructions and code belong to the official infrastructure of the vendor, Archetype AI.
Audit Metadata