skills/cosmix/loom/loom-wiring-test/Gen Agent Trust Hub

loom-wiring-test

Pass

Audited by Gen Agent Trust Hub on Jul 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides templates for defining functional verification commands (e.g., curl calls and CLI invocations) within a truths field. These commands are intended to be executed by a verification tool (loom check) to confirm functional integration. The instructions include explicit security constraints, such as the NO PATH TRAVERSAL rule which strictly prohibits the use of ../ in file paths.
  • [PROMPT_INJECTION]: The skill defines a surface for processing integration requirements into executable verification logic, which is susceptible to indirect prompt injection if untrusted source data is used.
  • Ingestion points: Loom plan stage metadata and feature requirements provided in the agent's context (SKILL.md).
  • Boundary markers: Uses structured YAML templates and specific refinement questions to validate logic; however, it lacks explicit delimiters for untrusted external content.
  • Capability inventory: Uses Bash, Write, Edit, and Grep tools to execute verification commands and inspect codebase patterns.
  • Sanitization: Prohibits path traversal sequences and provides strict formatting rules for YAML description fields to prevent syntax-based injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 25, 2026, 07:35 AM
Security Audit — agent-trust-hub — loom-wiring-test