turbo-doctor

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute goldsky CLI commands for pipeline diagnostics and management.
  • Evidence includes commands like goldsky project list, goldsky turbo list, goldsky turbo logs, goldsky turbo restart, and goldsky turbo delete.
  • The skill follows a strict diagnostic workflow and requires user confirmation before executing potentially destructive actions like delete or restart --clear-state.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes pipeline logs which are derived from external data sources and processing errors, creating an attack surface for indirect prompt injection.
  • Ingestion points: The skill fetches the last 100 lines of logs using goldsky turbo logs <pipeline-name> --tail 100 2>&1 in SKILL.md.
  • Boundary markers: The instructions do not specify explicit delimiters or "ignore instructions" warnings for the log content being analyzed.
  • Capability inventory: The agent has the ability to restart, delete, and redeploy pipelines, as well as interact with secrets via goldsky secret list and goldsky secret create.
  • Sanitization: There are no explicit sanitization or filtering steps mentioned for the log output before analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 01:56 PM