webex-network-alerts
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from network devices and formats it into WebEx alerts, creating an attack surface where malicious device output could influence agent behavior or card rendering.
- Ingestion points: Network health check results (e.g., device names, IP addresses), real-time status metrics (CPU/Memory usage), log excerpts (symptoms, interface flapping details), and security audit findings described in
SKILL.md. - Boundary markers: The templates and workflows provided in
SKILL.mddo not include explicit delimiters or instructions to ignore embedded commands within the device-sourced data strings. - Capability inventory: The skill has the capability to post rich content to WebEx spaces via API (
Messages — Create), generate Adaptive Cards based on data, and upload file attachments (logs, reports). - Sanitization: There are no instructions or patterns provided for sanitizing, escaping, or validating device-originated strings before they are interpolated into the Markdown or Adaptive Card JSON structures.
Audit Metadata