skills/daocloud/daocloud-skills/dc/Gen Agent Trust Hub

dc

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [SAFE]: No malicious behavior, obfuscation, or unauthorized data access patterns were detected. The skill's functionality aligns with its stated purpose of providing a CLI interface for platform management.
  • [COMMAND_EXECUTION]: The skill executes the dc command-line tool. It follows a defensive 'search-inspect-execute' protocol defined in SKILL.md and references/catalog.md, which requires the agent to verify command schemas and authentication status before running operations.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes data from external sources (platform messages and audit logs).
  • Ingestion points: Data enters the context via commands like dc global-management message list-messages and dc global-management audit list-audits found in references/modules/global-management.md.
  • Boundary markers: The skill emphasizes the use of structured JSON output (-o json) and explicit command inspection (dc commands show) to help the agent distinguish between data and instructions.
  • Capability inventory: The skill can perform sensitive administrative tasks, such as managing users, roles, SSH keys, and access tokens.
  • Sanitization: There is no explicit instruction within the skill to sanitize the content of messages or logs before processing, though the structured workflow mitigates accidental execution risks.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 02:24 AM
Security Audit — agent-trust-hub — dc