docyrus-dynamic-form-design
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
docyrusCLI to perform operations on form layouts, including listing data source fields, fetching existing form configurations, and saving new layouts. These operations involve reading local JSON files using shell expansion and communicating with the Docyrus platform APIs.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and author form layout documents that contain logic (JSONata) for conditional visibility and validation. This creates a surface for indirect prompt injection if an agent is asked to process a malicious or untrusted layout file.\n - Ingestion points: Layout configuration files read from the local file system and existing form data retrieved via CLI commands.\n
- Boundary markers: The skill provides a formal JSON schema for structure validation and a checklist for manual verification of field slugs and identifiers.\n
- Capability inventory: The
docyrusCLI enables full CRUD (Create, Read, Update, Delete) capabilities for form configurations on the target data source.\n - Sanitization: The skill relies on schema validation and the internal conversion logic of the platform's form renderer to ensure data integrity.\n- [DYNAMIC_EXECUTION]: The skill defines a system where JSONata expressions are evaluated at runtime to determine form states such as
computedHidden,computedRequired, andcomputedFormula. This allows for dynamic logic execution within the scope of the form rendering environment.
Audit Metadata