paligo-api
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructional examples for executing
curlcommands to interact with the Paligo API and running a provided Python script (scripts/validate_paligo_xml.py) for local XML schema and identifier validation. - [DATA_EXFILTRATION]: The skill documentation and provided Python snippets facilitate network requests to the official Paligo API domains
*.paligoapp.comandapi.paligo.net. These operations are consistent with the skill's primary purpose of CCMS integration. - [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow for ingesting and processing DocBook XML content retrieved from external API endpoints. While this ingestion represents a theoretical attack surface for indirect prompt injection, the skill includes structural validation logic to verify that critical Paligo-managed identifiers are preserved and that the XML remains well-formed.
Audit Metadata