zscaler-identity
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The provided file is a markdown documentation file that defines tool interfaces and configuration prerequisites. It does not contain any executable scripts, shell commands, or obfuscated payloads.
- [INDIRECT_PROMPT_INJECTION]: The skill defines tools to ingest data from external Zscaler APIs (users, groups, departments). While this creates a surface for indirect prompt injection if the source data is compromised, the toolset is limited to read operations (list and get), which minimizes the risk of automated exploitation.
- Ingestion points: Data returned from list_users, get_user, list_groups, and other IdP retrieval tools (SKILL.md).
- Boundary markers: None present in the instruction file.
- Capability inventory: Read-only access to identity provider metadata and user details.
- Sanitization: No sanitization or validation logic is defined within the skill metadata.
Audit Metadata