eve-ng-lab-management
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes external data from the EVE-NG platform (lab metadata, node configurations, and image lists), creating a potential surface for indirect prompt injection.\n
- Ingestion points: Data enters the agent context through tools such as
eve_list_labs,eve_get_lab, andeve_list_images(found inSKILL.md).\n - Boundary markers: The instructions lack explicit delimiters or warnings to ignore embedded instructions within processed lab data.\n
- Capability inventory: The skill allows for lab creation, deletion, and archive import/export (
SKILL.md), and provides instructions to execute the system binary/usr/sbin/ishare2(references/operational-guardrails.md).\n - Sanitization: No specific sanitization or validation logic for external platform content is described in the provided files.\n- [COMMAND_EXECUTION]: The skill documentation instructs the agent to utilize the
/usr/sbin/ishare2system utility for performing image inventory checks when requested images are missing (references/operational-guardrails.md). While this is a common management utility for EVE-NG environments, it involves the execution of a system binary via an absolute path.
Audit Metadata