manage-ai-employees
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes data from the Dozaldevs platform that could contain malicious instructions embedded by external actors or other users.
- Ingestion points: Multiple commands, including
dozaldevs list-dozals,dozaldevs preview-dozal-brain, anddozaldevs list-members(referenced inSKILL.mdandreferences/checking-and-undoing.md), ingest metadata, role names, and compiled instructions directly into the agent's context. - Boundary markers: The instructions do not define clear boundary markers or provide warnings to the agent to ignore potentially executable instructions within the retrieved data, which could lead the agent to follow malicious commands stored in employee configurations.
- Capability inventory: The skill allows for high-impact actions, such as deleting employees (
delete-dozal), modifying billing settings (get-billing), and applying organization-wide configuration snapshots (apply-org-snapshot) that could be abused if an injection succeeds. - Sanitization: There is no evidence of sanitization, filtering, or validation of the content returned by the
dozaldevsCLI before it is processed by the agent.
Audit Metadata