oraclecloud-sdk-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill provides code patterns that read authentication data from
~/.oci/config. While this is a sensitive path containing credentials, its use is the standard and necessary method for authenticating the OCI SDK as described in the skill's primary purpose. - [EXTERNAL_DOWNLOADS]: Recommends the installation of the
ociPython package. This is the official SDK for Oracle Cloud Infrastructure, which is a well-known service. - [INDIRECT_PROMPT_INJECTION]: The skill implements patterns for fetching and processing resource data from OCI (e.g., listing instances or regions), which introduces a surface for indirect prompt injection if the resource data contains malicious instructions.
- Ingestion points: OCI SDK calls such as
list_instances()andlist_regions()inSKILL.md. - Boundary markers: None present in the provided code snippets to distinguish between external data and instructions.
- Capability inventory: The skill is configured with
Write,Edit, andBashcapabilities. - Sanitization: No explicit validation or sanitization of the remote resource metadata is demonstrated in the code examples.
Audit Metadata