ops-client
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external desktop environments, creating a potential surface for indirect prompt injection attacks.\n
- Ingestion points: The agent reads window titles, process identities, accessibility labels, and responses from local application control planes (CLI/HTTP/socket) as specified in references/usage.md and references/eval-cases.md.\n
- Boundary markers: The instructions specify "evidence boundaries" and "authorized side effects" to limit the scope of interactions and mitigate the impact of untrusted data.\n
- Capability inventory: The skill grants the agent capabilities to execute system commands (e.g., screencapture), interact with accessibility controls (e.g., AXPress), and communicate with local application interfaces.\n
- Sanitization: The content does not define specific technical sanitization or validation procedures for the metadata and UI strings retrieved from external processes.
Audit Metadata