security-enablement-audit
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses curl to interact with Azure DevOps REST APIs. These commands are executed to retrieve configuration data and use environment variables for authentication, which is consistent with the skill's auditing purpose.
- [EXTERNAL_DOWNLOADS]: Data is fetched from dev.azure.com and advsec.dev.azure.com. These are official, well-known Microsoft Azure DevOps service domains used for security management.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of repository and project metadata from external APIs.
- Ingestion points: API responses from _apis/git/repositories and _apis/management/enablement containing repository names and IDs.
- Boundary markers: The instructions do not specify the use of delimiters when presenting this data to the user.
- Capability inventory: The skill uses curl for data retrieval; it does not perform file system writes or execute secondary commands based on the ingested data.
- Sanitization: The skill identifies data fields for reporting but does not explicitly mention sanitizing these fields before inclusion in the final summary.
Audit Metadata