cohere-ci-integration
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with external repository content, which constitutes an ingestion surface for potentially untrusted data. * Ingestion points: The skill utilizes Read, Glob, and Grep tools to inspect code and configuration within the target repository (SKILL.md). * Boundary markers: The skill includes clear instructions to ignore embedded instructions by mandating offline lane requirements and asserting that no network fallback is possible. * Capability inventory: The skill utilizes Write and Edit tools to modify files and implementation details (SKILL.md). * Sanitization: Instructions explicitly mandate the redaction of keys, authorization headers, prompts, and customer identifiers from all outputs and test metadata.
- [EXTERNAL_DOWNLOADS]: The skill references and documents official SDKs and tools from well-known services. * It identifies official Python (cohere==7.1.1) and TypeScript (cohere-ai@8.1.0) SDKs for implementation (references/official-docs.md). * It provides links to official documentation and status pages at cohere.com and status.cohere.com.
Audit Metadata