maintainx-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides examples using
curlto interact with the MaintainX API (api.getmaintainx.com). This is a well-known service, and the commands are used appropriately for the skill's primary purpose of maintenance management. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it processes data from external sources (CSV files and API responses).
- Ingestion points: The skill reads local CSV files (e.g.,
assets.csv) and fetches location and asset data from the MaintainX API. - Boundary markers: The provided scripts do not use specific delimiters or instructions to the agent to ignore potentially malicious instructions embedded within the processed data.
- Capability inventory: The skill utilizes network tools (
curl), file system access (Read,Write,Edit), and package management capabilities (npm). - Sanitization: There is no evidence of sanitization or strict schema validation for the data ingested from CSV rows or API payloads before it is used in logic or displayed.
Audit Metadata