paligo-api

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructional examples for executing curl commands to interact with the Paligo API and running a provided Python script (scripts/validate_paligo_xml.py) for local XML schema and identifier validation.
  • [DATA_EXFILTRATION]: The skill documentation and provided Python snippets facilitate network requests to the official Paligo API domains *.paligoapp.com and api.paligo.net. These operations are consistent with the skill's primary purpose of CCMS integration.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow for ingesting and processing DocBook XML content retrieved from external API endpoints. While this ingestion represents a theoretical attack surface for indirect prompt injection, the skill includes structural validation logic to verify that critical Paligo-managed identifiers are preserved and that the XML remains well-formed.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 03:42 PM