eventb
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of specialized CLI tools (
rossiandeventb-animate) to validate, build, and model-check formal specifications. These commands are executed in the local shell environment. - Evidence: Found in
SKILL.mdand projectREADME.mdfiles, which provide command templates for the agent to run (e.g.,rossi validate .,eventb-animate --json report.json model.zip). - [INDIRECT_PROMPT_INJECTION]: The skill operates on user-provided requirements and formal model files, creating a potential surface where malicious instructions could be embedded in the data processed by the agent.
- Ingestion points: The agent reads and processes
.eventbspecification files (e.g.,examples/counter/counter_abstract.eventb) and descriptiveREADME.mdfiles containing requirements. - Boundary markers: The skill relies on the strict formal grammar of the Event-B language to delimit data; no specific natural language boundary markers or 'ignore' instructions are defined for the requirements phase.
- Capability inventory: The agent has the capability to execute shell commands via
rossi(for formatting, validation, and building) andeventb-animate(for model checking, animation, and test generation) as defined inSKILL.mdandreferences/tooling.md. - Sanitization: Inputs are subjected to strict semantic and syntactic validation by the
rossiparser during thevalidateandbuildsteps before any animation or model checking occurs.
Audit Metadata