acreadiness-policy
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes the
agentrctool from the official Microsoft repository on GitHub vianpx. This is a standard operation for utilizing the tool and its ecosystem.\n- [COMMAND_EXECUTION]: Invokes shell commands to run theagentrcCLI for generating readiness reports, scaffolding new policy files, and applying existing configurations. User-provided arguments for paths or packages are interpolated into these commands.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests external policy configurations (JSON) which customize the readiness scoring logic and could influence the output generated by downstream reporting agents.\n - Ingestion points: Policy files located at user-defined local paths or remote packages are accessed during the
applysub-command execution.\n - Boundary markers: No specific delimiters or safety instructions are provided to the agent to distinguish between the policy configuration and potential embedded instructions within the JSON content.\n
- Capability inventory: The skill has the ability to execute shell commands via
npxand pass results to theassessskill andai-readiness-reporteragent.\n - Sanitization: The skill relies on the
agentrctool's internal schema validation and JSON parsing to ensure the integrity of the configuration data.
Audit Metadata