scbe-kernel-external-toolcall-specialist
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill architecture is designed to ingest data from external platforms such as Notion, GitHub, and Hugging Face and process it through LLM chains (e.g., the 'synthesize' step in 'references/arxiv-chain.yaml'). This creates a surface for indirect prompt injection where malicious instructions embedded in external documents could influence subsequent agent actions.
- Ingestion points: External data enters the context via connectors like 'notion.harvest' and 'github.fetch' (identified in 'references/arxiv-chain.yaml').
- Boundary markers: The 'SKILL.md' and 'references/toolcall-playbook.md' define a 'Turnstile' mapping and 'DecisionRecord' output to gate actions based on the domain (e.g., requiring a 'HOLD' for human review on arXiv or patent tasks).
- Capability inventory: The skill supports file writes (via 'latex.compile'), network operations (via various connectors), and potentially local command execution (via 'local.exec').
- Sanitization: The skill uses 'tools/schema_validate.py' and 'tools/chain_lint.py' to enforce structured output and validate tool-call logic against predefined schemas.
- [COMMAND_EXECUTION]: The skill documentation and tools identify 'local.exec' as a known tool ('tools/chain_lint.py') and provide a safety checklist for 'Command-Exec Nodes' ('references/toolcall-playbook.md'). This indicates a core capability for local command execution. The skill attempts to mitigate risk by recommending command allowlists and restricting filesystem writes to a workspace subtree.
Audit Metadata