axiom-analyze-triage
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
xcsym triageshell command to process crash signatures stored in a temporary JSONL file. This execution is standard for the skill's purpose of analyzing aggregated telemetry data. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data (crash signatures, frame lists, and culprits) from Sentry and App Store Connect APIs. While this data is processed by the
xcsymtool and summarized into a Markdown report, there are no explicit boundary markers or sanitization steps mentioned for the ingested diagnostic strings. However, the risk is mitigated by the specialized nature of the triage tool and the structured reporting format. - [EXTERNAL_DOWNLOADS]: The skill initiates network requests to the Sentry API (
/api/0/projects/...) and App Store Connect diagnostic services to fetch issue data. These interactions target well-known, official service endpoints necessary for the primary function of the skill.
Audit Metadata