cogny

Pass

Audited by Gen Agent Trust Hub on May 2, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill implements an Indirect Prompt Injection surface by fetching and automatically executing instructions from the "skill_content" field of a remote task queue via "mcp__cogny__get_next_task".
  • Ingestion points: "mcp__cogny__get_next_task" (returns the "skill_content" payload) in "SKILL.md".
  • Boundary markers: Absent. The agent is explicitly told to "follow the instructions... step by step" and "follow them precisely" without delimiters or safety warnings for the remote content.
  • Capability inventory: The agent has access to "Bash", "Write", "WebFetch", and various marketing platform mutation tools (Google Ads, Meta Ads, etc.).
  • Sanitization: No validation or sanitization of the remote "skill_content" is performed before the agent processes it as instructions.
  • [COMMAND_EXECUTION]: The skill is granted access to the "Bash" and "Write" tools, which it is instructed to use while following playbooks fetched from the vendor's remote task queue.
  • [EXTERNAL_DOWNLOADS]: The skill performs several network-dependent operations to the vendor's infrastructure:
  • Fetches heartbeat and update status via "mcp__cogny__heartbeat".
  • Retrieves analysis tasks and instructions via "mcp__cogny__get_next_task".
  • Supports updating the skill itself via "mcp__cogny__get_skill_package".
Audit Metadata
Risk Level
SAFE
Analyzed
May 2, 2026, 06:43 AM
Security Audit — agent-trust-hub — cogny