groq-prod-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to read and analyze the target application's Groq integration and configuration files. This creates a potential risk surface where untrusted content within the codebase could attempt to influence agent behavior.
- Ingestion points: Target application integration code and configuration files as specified in
SKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided.
- Capability inventory: The skill is granted
ReadandBash(curl:*)capabilities. The bash script inreferences/go-live.mdusescurlto make network requests. - Sanitization: No data validation or sanitization routines are implemented.
- [COMMAND_EXECUTION]: The skill provides a go-live verification bash script (
references/go-live.md) that uses shell commands to perform service health checks. - Evidence: The script uses
curlandjqto validate API responses and rate limits. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to external domains to verify service status and credential validity.
- Evidence: Network operations target
status.groq.comandapi.groq.comto check service status and API key validity.
Audit Metadata