codevasp-uppsala-screening-guide
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch documentation directly from the vendor's official site (docs.codevasp.com). This behavior is intended to maintain the accuracy and currency of the API reference material provided to developers.
- [INDIRECT_PROMPT_INJECTION]: The skill creates an ingestion surface by retrieving content from external URLs at docs.codevasp.com. While this is a known attack surface, the risk is low as the source is the official vendor documentation.
- Ingestion point: Remote markdown documentation pages under the docs.codevasp.com domain.
- Boundary markers: The instructions do not define specific delimiters or warnings to ignore instructions embedded within the fetched content.
- Capability inventory: The skill utilizes
curlfor network retrieval of documentation; it does not request capabilities for file system modification, command execution, or data exfiltration. - Sanitization: No explicit sanitization or validation logic is specified for the documentation content fetched via curl.
Audit Metadata