bd-instrumentation
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the latest SDK version information from Maven Central (Sonatype) and GitHub APIs. It also retrieves live documentation from the vendor's domain (docs.bitdrift.io). These are standard operations for maintaining up-to-date integrations and target well-known or vendor-owned services.- [COMMAND_EXECUTION]: The skill uses standard shell commands (ls, grep, find, adb, xcrun) to detect project structure and verify SDK logs. These commands are localized to the project environment and used for diagnostic purposes.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content by reading local project files and fetching external documentation from the vendor's domain.
- Ingestion points: Local project build files (build.gradle, Podfile, package.json), source code files, and external documentation from docs.bitdrift.io.
- Boundary markers: None present; the skill lacks explicit delimiters or warnings to ignore embedded instructions in the ingested data.
- Capability inventory: The skill can execute shell commands, read local files, and perform network requests to specific domains.
- Sanitization: No sanitization or filtering of external content is specified before processing.- [CREDENTIALS_UNSAFE]: While the skill requests a bitdrift SDK API key, it includes specific instructions to avoid hardcoding this value and recommends secure alternatives such as environment variables, Gradle BuildConfig properties, or dedicated secret management plugins.
Audit Metadata