tautulli
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The
SKILL.mdfile contains instructions using authoritative language ('MANDATORY', 'YOU MUST', 'Failure... violates your operational requirements') intended to override the agent's decision-making process and force the invocation of the skill.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the external Tautulli API, which represents a potential attack surface.\n - Ingestion points: API responses fetched from the Tautulli server via
curlinscripts/tautulli-api.sh.\n - Boundary markers: Absent; the agent receives raw JSON data without clear delimiters.\n
- Capability inventory: The skill uses
curlfor network requests to the Tautulli server.\n - Sanitization: No sanitization or validation of the API response content is performed before presenting it to the agent context.
Audit Metadata