devops-incident-response
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill identifies a significant attack surface for indirect prompt injection.\n
- Ingestion points: Untrusted data enters the agent context through user reports (Zendesk, Intercom), social media mentions, and external monitoring alert payloads as described in
SKILL.md(Detection Phase) andreferences/incident-lifecycle.md.\n - Boundary markers: The provided templates for runbooks, postmortems, and status updates in
SKILL.mdand the reference docs lack delimiters or instructions to treat external content as data rather than instructions.\n - Capability inventory: The skill provides templates and scripts that use
kubectl(inSKILL.mdrunbook template), the PagerDuty API, and the AWS SDK (boto3inrunbook_automation/auto_responder.py), allowing for significant infrastructure and service manipulation.\n - Sanitization: There is no evidence of filtering, escaping, or validation logic for the external content before it is processed by the agent.\n- [PROMPT_INJECTION]: The skill contains massive volumes of repetitive generic content used to bloat the agent's context window.\n
- Evidence: Files such as
references/architecture-patterns.md,references/security-best-practices.md, and others contain 150 sections each of repetitive DevOps boilerplate.\n - Risk: This technique can be used to displace critical security instructions from the active context window (context overflow) or cause excessive token costs and degraded model performance.
Audit Metadata