asyncio
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides code templates for building asynchronous web servers (using
aiohttpandFastAPI) that ingest untrusted external data via JSON payloads. This represents a potential surface for indirect prompt injection if the generated code is used to process adversarial input without proper sanitization. - Ingestion points:
SKILL.md(e.g.,data = await request.json()in HTTP server examples). - Boundary markers: Absent in the provided code templates.
- Capability inventory: The skill demonstrates capabilities including network operations (
aiohttp.ClientSession) and database operations (asyncpg,motor). - Sanitization: Absent, as the code focus is on demonstrating concurrency patterns.
- [EXTERNAL_DOWNLOADS]: Documentation includes instructions to install well-known and reputable Python libraries from official registries.
- Evidence: Mentions
pip installforaiohttp,httpx,fastapi,asyncpg,aiomysql,motor, andpytest-asyncio. - [COMMAND_EXECUTION]: The skill references standard package management and testing commands as part of the development toolchain documentation.
- Evidence: Includes
pip installandpytestusage examples.
Audit Metadata