tuckmark-agent-import-user
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from order exports and product pages, creating a surface for indirect prompt injection.
- Ingestion points: Order export files and product-page bodies accessed during the research phase.
- Boundary markers: Instructions define a 'Privacy Boundary' to prevent data leakage, but lack explicit instructions to disregard embedded commands in the processed data.
- Capability inventory: The agent has the ability to execute
tuckmarkCLI commands to interact with a local inventory system. - Sanitization: No explicit sanitization or validation of the ingested order data is described before it is used to generate inventory proposals.
- [COMMAND_EXECUTION]: The skill instructions direct the agent to interact with the local environment via the
tuckmarkCLI. - The workflow involves running multiple shell commands, including
tuckmark agent-import createandtuckmark agent-import fulfill. These commands are local and interact with a specific service via local IPC.
Audit Metadata