auvik-lifecycle

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection by ingesting untrusted configuration data from managed network devices via the Auvik API.
  • Ingestion points: The auvik_list_configurations tool retrieves the full body of device configuration backups.
  • Boundary markers: Absent. The instructions do not define delimiters or explicit warnings for the agent to ignore instructions embedded within the retrieved configurations.
  • Capability inventory: The skill accesses sensitive network configuration data, device lifecycle status, and warranty information for report generation and refresh planning.
  • Sanitization: Absent. There are no defined processes for filtering or sanitizing the retrieved configuration content before it is added to the agent's context.
  • [CREDENTIALS_UNSAFE]: The skill utilizes environment variables (AUVIK_USERNAME, AUVIK_API_KEY) for API authentication, which is the recommended practice for secure secret management.
  • [SAFE]: Network communication is targeted at well-known and official Auvik API endpoints.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 04:29 PM
Security Audit — agent-trust-hub — auvik-lifecycle