camunda-feel
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for using the
c8ctlcommand-line utility to evaluate and debug FEEL expressions. This is a standard development and operational task for the Camunda platform. - [DYNAMIC_EXECUTION]: FEEL expressions are dynamically evaluated using either a local JavaScript-based engine (
feelin) or a remote Scala-based cluster engine. This dynamic evaluation is the intended primary purpose of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill documents the
fromAi()function, which defines parameters meant to be populated by an LLM, creating an interface for AI-generated data ingestion. - Ingestion points: FEEL expressions and variable contexts passed to the
c8ctl feel evaluatecommand inSKILL.md. - Boundary markers: None explicitly defined in the instructions.
- Capability inventory: Evaluation of arithmetic, logical, and context-based expressions, and execution of the
c8ctlCLI inSKILL.md. - Sanitization: The skill describes type validation and warnings for functional correctness but does not include specific security-focused sanitization for the expressions.
Audit Metadata