frontend-session-rca
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external telemetry data from session dumps, which represents a potential indirect prompt injection surface.
- Ingestion points: Telemetry data is saved to and read from
/tmp/session-<session_id>.txtas described inSKILL.md(Sections 3 and 4). - Boundary markers: Present. The skill explicitly instructs the agent in the 'Grounding rules' section to treat the dump as untrusted data and ignore any embedded instructions, prompts, or links.
- Capability inventory: The skill possesses capabilities to execute shell commands via the
gcxCLI tool (gcx frontend sessions get,gcx logs query,gcx traces get). - Sanitization: Programmatic sanitization of the telemetry dump content prior to reading is absent, relying instead on the model's adherence to the safety instructions.
- [COMMAND_EXECUTION]: The skill invokes local CLI commands (
gcx) using parameters collected from the user or data fields (e.g.,<session_id>,<datasource_uid>,<logql>), which could pose a risk if input parameters are not safely handled by the underlying execution environment.
Audit Metadata