thunderwave
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to handle user-supplied targets and payloads for webhooks and device automations, which serves as a potential vector for indirect instructions.
- Ingestion points: The skill ingest targets and payloads during the 'Procedure' phase (Steps 2 and 3) in SKILL.md.
- Boundary markers: The skill implements robust boundary markers by requiring explicit confirmation of the payload, boundary, and rollback plan before any action is taken.
- Capability inventory: The skill references capabilities to trigger webhooks and device integrations, although the specific tools are not defined within this file.
- Sanitization: The verification steps mandate the separation of confirmed facts from assumptions and inferences, reducing the risk of unintended instruction execution.
Audit Metadata