coreweave-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for ingesting and processing untrusted data from external webhooks and user-defined workload requests, creating a potential attack surface.
- Ingestion points: Processes webhook payloads in
verifyCoreWeaveWebhookand user-provided workload data invalidateWorkloadRequest. - Boundary markers: Recommends the use of cryptographic signatures (HMAC) and schema-based validation (Zod) to ensure data integrity and prevent injection.
- Capability inventory: Utilizes
kubectlvia the Bash tool for namespace and infrastructure management, along with standard file system operations. - Sanitization: Provides robust code for input sanitization using regular expressions and logic for redacting sensitive fields from logs.
- [COMMAND_EXECUTION]: The skill provides instructions for executing
kubectlcommands to apply network policies and run diagnostic checks within a Kubernetes cluster, which is consistent with its stated purpose of cloud security management.
Audit Metadata