skills/daocloud/daocloud-skills/dce/Gen Agent Trust Hub

dce

Pass

Audited by Gen Agent Trust Hub on May 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill is designed to operate primarily through the execution of the dce command-line utility to perform administrative and monitoring tasks.
  • [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it ingests and processes untrusted data from the platform's backend.
  • Ingestion points: Data enters the agent's context through commands that query logs and events, such as dce insight log query-log and dce insight event query-events found in references/modules/insight.md.
  • Boundary markers: The instructions do not define clear delimiters or include specific warnings to the agent to ignore instructions embedded within retrieved data.
  • Capability inventory: The skill provides access to sensitive operations, including managing user accounts, creating access tokens (dce global-management account create-access-token), and creating SSH keys (dce global-management account create-ssh-key), as documented in references/modules/global-management.md.
  • Sanitization: The workflow lacks explicit steps for sanitizing or validating external content before the agent processes it.
Audit Metadata
Risk Level
SAFE
Analyzed
May 29, 2026, 05:37 AM
Security Audit — agent-trust-hub — dce