phoenix-error-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting and analyzing untrusted data from traces, spans, and sessions, which could contain malicious instructions designed to influence the agent.
- Ingestion points: Processes data fetched from the Phoenix server via
px trace get,px span get, and GraphQL queries (documented in references). - Boundary markers: The workflow does not explicitly instruct the agent to use delimiters or security warnings when reading fetched LLM inputs and outputs.
- Capability inventory: The agent has permissions to write notes and annotations back to the server and execute shell commands for local file management.
- Sanitization: There is no evidence of specific sanitization or filtering logic for the content retrieved from the traces.
- [COMMAND_EXECUTION]: The skill includes shell commands for local environment setup and sidecar file management.
- Evidence: The coding annotation section provides bash snippets using
sedfor identifier sanitization,mkdir -pfor directory creation, andtestfor file existence checks. These commands are localized to the.px/coding/directory.
Audit Metadata