docyrus-automation-design
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill facilitates the creation of automations that interpolate untrusted record data into AI prompts and notifications, creating an indirect prompt injection surface. * Ingestion points: Data entering via record-based triggers (e.g., recordCreated) or external webhooks. * Boundary markers: No specific boundary markers or 'ignore embedded instructions' warnings are provided for the AI prompt templates. * Capability inventory: The system supports ai-prompt, ai-agent, and execute-script nodes, as well as sending emails/notifications. * Sanitization: The documentation (references/trigger-and-node-catalog.md) recommends using Handlebars-style quoting ({{ q path }}) for SQL safety in script nodes, but lacks equivalent sanitization instructions for AI prompt construction.
- [COMMAND_EXECUTION]: The skill uses the docyrus CLI for managing automation resources, which is expected vendor-provided functionality.
- [REMOTE_CODE_EXECUTION]: The execute-script node type allows defining and running JavaScript in a sandboxed environment on the Docyrus platform, representing a controlled dynamic execution capability.
- [DATA_EXFILTRATION]: Action nodes utilizing the execute-script type can be configured with an allowNetwork flag to enable outbound HTTP requests, which represents a potential data exfiltration vector if scripts are misconfigured.
Audit Metadata