guidewire-sdk-patterns

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the @guidewire/jutro-cli package via npx for project initialization in the implementation guide. This is a standard utility for Guidewire development workflows.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for fetching and processing data from external Guidewire Cloud API endpoints, which creates an attack surface for instructions embedded in external data.
  • Ingestion points: Data is ingested via fetch calls in SKILL.md and parsed as JSON in methods such as patchResource, paginate, and createClaim.
  • Boundary markers: The instructions do not include specific delimiters or warnings to ignore instructions embedded in the API responses.
  • Capability inventory: The skill uses network tools (fetch, Bash(curl:*)), file system tools (Read, Write, Edit), and shell execution (Bash(jq:*)).
  • Sanitization: The provided implementation patterns do not include explicit sanitization or validation of the content returned by the API.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:46 AM