cogny
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill implements an Indirect Prompt Injection surface by fetching and automatically executing instructions from the "skill_content" field of a remote task queue via "mcp__cogny__get_next_task".
- Ingestion points: "mcp__cogny__get_next_task" (returns the "skill_content" payload) in "SKILL.md".
- Boundary markers: Absent. The agent is explicitly told to "follow the instructions... step by step" and "follow them precisely" without delimiters or safety warnings for the remote content.
- Capability inventory: The agent has access to "Bash", "Write", "WebFetch", and various marketing platform mutation tools (Google Ads, Meta Ads, etc.).
- Sanitization: No validation or sanitization of the remote "skill_content" is performed before the agent processes it as instructions.
- [COMMAND_EXECUTION]: The skill is granted access to the "Bash" and "Write" tools, which it is instructed to use while following playbooks fetched from the vendor's remote task queue.
- [EXTERNAL_DOWNLOADS]: The skill performs several network-dependent operations to the vendor's infrastructure:
- Fetches heartbeat and update status via "mcp__cogny__heartbeat".
- Retrieves analysis tasks and instructions via "mcp__cogny__get_next_task".
- Supports updating the skill itself via "mcp__cogny__get_skill_package".
Audit Metadata