ops-fires

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes dynamic context injection placeholders to run local binaries (ops-infra, ops-ci, ops-external) from the plugin's root directory at load time. These commands gather the initial state for the infrastructure, CI, and external project health dashboards.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain instructions designed to manipulate the agent's logic for incident classification and fix dispatching.\n
  • Ingestion points: The agent reads data from Sentry issue details, ECS logs via aws logs tail, and GitHub Actions failure logs via gh run view.\n
  • Boundary markers: The instructions do not specify the use of clear delimiters or instructions to ignore embedded commands within the ingested logs or incident reports.\n
  • Capability inventory: The skill possesses significant capabilities, including the ability to execute Bash commands, stream live logs via Monitor, and dispatch new Agent instances with repository access to apply fixes.\n
  • Sanitization: There is no mention of sanitizing or filtering the external content before it is parsed for severity classification or used to guide sub-agent investigations.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:54 PM