helix-cli
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill functions by invoking the
helixCLI tool to perform database operations, resource management, and API interactions. This involves executing shell commands with various arguments based on user tasks.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides the capability to ingest data from external files through commands likehelix query --file <path>. This introduces a surface where malicious content within those files could influence the agent's output or subsequent actions.\n - Ingestion points: File paths passed to the
helix querycommand (SKILL.md, REFERENCE.md).\n - Boundary markers: No specific boundary markers or 'ignore' instructions are provided for the content of processed files.\n
- Capability inventory: Access to the
helixCLI which includes network operations to the database service, local file reading, and service management.\n - Sanitization: The skill does not describe any sanitization or validation of the contents of the files it processes.\n- [CREDENTIALS_UNSAFE]: Management commands, such as
helix database create, return sensitive tokens upon execution. Although the skill explicitly directs the agent not to store these secrets, their presence in the command output results in transient exposure within the agent's context.
Audit Metadata