cekura-results-report
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from test result explanations and call transcripts ingested via tools like
mcp__cekura__runs_bulk_retrieveandmcp__cekura__call_logs_retrieve. The skill incorporates significant security mitigations: it provides explicit instructions to treat all tool output strictly as data, forbids following any instructions embedded within that data, and mandates the scrubbing of all personal identifiable information (PII) before report generation. The structured JSON output format further limits the risk of instruction leakage. - [SAFE]: The skill relies on platform-provided, read-only tools and interacts with official vendor domains. It does not perform arbitrary shell commands, network operations to unknown hosts, or persistent file system modifications. All external dependencies trace back to the vendor's infrastructure.
Audit Metadata