eve-ng-node-operations
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Implements several tools for node lifecycle management including creation, deletion, and state control (start/stop/wipe) within an EVE-NG server.
- [CREDENTIALS_UNSAFE]: The skill metadata requests environment variables for
EVE_USERandEVE_PASSWORDto authenticate with the EVE-NG API. This is a standard requirement for such tools and does not indicate hardcoded credentials. - [PROMPT_INJECTION]: The skill ingests data from the EVE-NG API and potentially external inventory tools like
ishare2. This constitutes an indirect prompt injection surface if strings within the EVE-NG environment (such as node names or descriptions) are manipulated by an attacker. - Ingestion points: Responses from
eve_list_nodes,eve_get_node, andishare2inventory output. - Boundary markers: Not explicitly defined in the provided instruction files.
- Capability inventory: Full lifecycle control of lab nodes including destructive actions like
eve_wipe_nodeandeve_delete_node. - Sanitization: No explicit content filtering or escaping is specified for the ingested data.
Audit Metadata