pentest-gemini-az
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute shell commands using the
az restutility. It constructs these commands dynamically by interpolating variables like<FULL_URL>and<JSON>bodies. If these inputs are derived from external, untrusted sources within the cloud environment (such as resource names or tags) and are not properly sanitized, it could lead to local command injection within the agent's execution environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection.\n - Ingestion points: The skill ingests data from Azure Resource Manager (ARM) and Microsoft Graph APIs, which could contain attacker-controlled content.\n
- Boundary markers: There are no explicit instructions or delimiters defined to separate instructions from the data fetched from external APIs.\n
- Capability inventory: The skill possesses extensive capabilities to read, create, update, and delete resources across Azure and Microsoft 365 tenants.\n
- Sanitization: The instructions do not describe any mechanisms for sanitizing, validating, or escaping data retrieved from cloud environments before it is processed or used in subsequent commands.
Audit Metadata