component-scaffolder

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the dxs CLI to interact with the Datex Studio platform. It executes commands such as dxs configuration get, dxs configuration validate, and dxs configuration upsert to manage component lifecycles on a specified branch.
  • [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface as it processes external input to generate configuration files. 1. Ingestion points: User-provided Name and Description strings (SKILL.md, Workflow step 1). 2. Boundary markers: None identified; user input is directly placed into the body.json template. 3. Capability inventory: The skill has the ability to write to remote branches via dxs configuration upsert (SKILL.md, Workflow step 7). 4. Sanitization: The skill validates that the description is 100 characters or less to comply with database constraints, but does not perform content sanitization.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 01:11 PM
Security Audit — agent-trust-hub — component-scaffolder