eve-pipelines-workflows
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill describes legitimate DevOps orchestration capabilities for the 'eve' tool. It emphasizes best practices for credential security by using secret resolution placeholders that are automatically redacted by the runtime engine.\n- [INDIRECT_PROMPT_INJECTION]: The workflow and pipeline system described in SKILL.md constitutes an architecture that processes data from potentially untrusted external sources.\n
- Ingestion points: External data flows from command-line arguments (--input, --inputs), project manifest files (.eve/manifest.yaml), and incoming webhooks from GitHub or Slack.\n
- Boundary markers: The documentation highlights that secrets are redacted, but it does not specify explicit prompt delimiters or sanitization logic for user-provided data interpolated into agent prompts.\n
- Capability inventory: The platform can execute shell scripts (script steps), perform infrastructure modifications (build, release, deploy), and call LLM agents (agent steps) as documented in SKILL.md.\n
- Sanitization: Platform-level redaction is applied to resolved secret keys to prevent credential leakage in logs.
Audit Metadata