fable-method

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied 'task_description' and 'domain_adapter' inputs to drive a multi-step execution loop, which introduces an attack surface where instructions embedded in external data could influence the agent's logic. Ingestion points include the 'task_description' and optional 'domain_adapter' files defined in SKILL.md. Boundary markers are not explicitly enforced in the input schema, though procedural gates like the 'Fit Gate' and 'Classify the Ask' steps provide logical boundaries. The capability inventory includes shell command execution for testing and compilation, as well as file system read/write access. No explicit sanitization of external task content is detailed.- [COMMAND_EXECUTION]: The skill facilitates the execution of shell commands for running compilers, linters, and test runners as part of its 'Verify by Observation' step. This capability is used to generate verifiable evidence of task completion within a bounded engineering context.- [EXTERNAL_DOWNLOADS]: The skill's documentation, specifically in the devops domain adapter, references fetching configuration and documentation from well-known and trusted sources like AWS, Google SRE guides, and OWASP to ensure technical accuracy and prevent configuration drift.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 03:40 PM