halo-asset-context
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_&_EXFILTRATION]: The skill requires sensitive credentials (
HALO_CLIENT_ID,HALO_CLIENT_SECRET) to authenticate with the Halo REST API. The instructions correctly direct the use of environment variables for these secrets, which is a standard and secure practice for secret management. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection attacks because it processes untrusted data from an external system.
- Ingestion points: External data enters the agent context via
halo_get_assetandhalo_get_asset_tickets, which fetch asset details and ticket descriptions from the Halo REST API (specified inSKILL.md). - Boundary markers: The instructions do not define specific delimiters or instructions to the agent to disregard embedded directives within the retrieved ticket data.
- Capability inventory: The skill uses a Python-based MCP server (
mcp-servers/halo-mcp/halo_mcp_server.py) to execute queries. While this skill is documented as read-only, it explicitly integrates withhalo-change-request, which possesses write capabilities in the target environment. - Sanitization: There is no evidence of data sanitization or filtering of the content retrieved from the Halo API before it is presented to the agent.
Audit Metadata