broll-onboarding
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local diagnostic and maintenance scripts, such as
production-preflight.mjsanddoctor.mjs, using Node.js to manage the environment state.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes JSON output from preflight scripts to determine necessary diagnostic and repair steps, creating a potential surface for indirect instruction injection.\n - Ingestion points: Result from
scripts/production-preflight.mjsas defined inSKILL.md.\n - Boundary markers: The instructions specify the consumption of a "compact JSON result."\n
- Capability inventory: The skill is capable of executing Node.js scripts and writing handoff documentation to the filesystem.\n
- Sanitization: The skill relies on structured JSON format for input but does not detail specific content sanitization or validation routines.
Audit Metadata