skills/fuzzystodd/the-nexus-protocol-token-dao/chainlink-confidential-ai-attester-skill/Gen Agent Trust Hub
chainlink-confidential-ai-attester-skill
Fail
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: HIGHDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions direct the agent to read and upload highly sensitive local documents, including bank statements, SEC brokerage statements, and government identification, to an external endpoint: 'https://confidential-ai-dev-preview.cldev.cloud'. The transmission of high-value personal financial and identity data to a non-standard domain not included in trusted service lists constitutes a significant exfiltration risk, regardless of the 'TEE' claims made in the documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection by processing untrusted external files (PDFs and PNGs). Ingestion points: The 'resources' field in the '/v1/inference' API request allows for the attachment of arbitrary document content. Boundary markers: The skill lacks protective delimiters or instructions to ignore embedded commands within processed documents. Capability inventory: The agent's access to 'Read', 'WebFetch', 'Write', 'Edit', and 'Bash' tools creates a high-impact environment for any successful injection. Sanitization: There are no specified mechanisms for validating or sanitizing the contents of the uploaded documents before they are analyzed by the LLM.
Recommendations
- AI detected serious security threats
Audit Metadata