cohere-local-dev-loop
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow where the agent writes code that ingests untrusted data from the Cohere API.
- Ingestion points: Data enters the environment via Cohere API responses within tests and service wrappers (e.g., tests/integration.test.ts).
- Boundary markers: The templates do not include specific delimiters or warnings to treat API-returned content as untrusted.
- Capability inventory: The skill uses Bash for package management and Write for generating the project structure.
- Sanitization: There is no explicit sanitization or schema validation of the API responses in the provided code examples.
Audit Metadata