onboard-context-matic
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes data from external sources and user inputs to guide its responses.
- Ingestion points: Phase 1a (workspace file names), Phases 3-6 (outputs from
ask,model_search, andendpoint_searchMCP tools), and user selections in Phases 2 and 4. - Boundary markers: Absent. The skill does not define specific delimiters or instructions to ignore potential commands within the tool-provided data.
- Capability inventory: Read-only access to workspace file names and execution of specific MCP tools. The skill does not include file-writing, network exfiltration, or shell execution capabilities.
- Sanitization: Absent. Data from the MCP server is presented to the user conversationally without explicit filtering.
- [SAFE]: The project language detection (Phase 1a) is limited to checking for the existence of common manifest files (e.g.,
package.json,pom.xml), which is a benign and standard practice for providing relevant documentation. - [SAFE]: The skill follows security best practices by explicitly instructing the agent to announce every tool call to the user before execution, ensuring transparency and preventing silent operations.
Audit Metadata