ops-fires
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes dynamic context injection placeholders to run local binaries (ops-infra, ops-ci, ops-external) from the plugin's root directory at load time. These commands gather the initial state for the infrastructure, CI, and external project health dashboards.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain instructions designed to manipulate the agent's logic for incident classification and fix dispatching.\n
- Ingestion points: The agent reads data from Sentry issue details, ECS logs via
aws logs tail, and GitHub Actions failure logs viagh run view.\n - Boundary markers: The instructions do not specify the use of clear delimiters or instructions to ignore embedded commands within the ingested logs or incident reports.\n
- Capability inventory: The skill possesses significant capabilities, including the ability to execute
Bashcommands, stream live logs viaMonitor, and dispatch newAgentinstances with repository access to apply fixes.\n - Sanitization: There is no mention of sanitizing or filtering the external content before it is parsed for severity classification or used to guide sub-agent investigations.
Audit Metadata