knowledge-catalog-discovery
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The scripts execute @toolbox-sdk/server@1.1.0 using npx, which fetches the package from the npm registry at runtime. This is a standard mechanism for utilizing versioned command-line utilities.\n- [COMMAND_EXECUTION]: The scripts in the scripts/ directory use child_process.spawn to run the npx command, passing user-provided parameters (like search queries and resource names) as arguments. This is the intended primary functionality for invoking the toolbox server. On Windows, the scripts use npx.cmd and implement double-quote escaping logic.\n- [DATA_EXFILTRATION]: The scripts access environment variables for Google Cloud authentication and configuration (e.g., GOOGLE_APPLICATION_CREDENTIALS, DATAPLEX_PROJECT). These credentials are used solely to authenticate with official Google Cloud services and are not exfiltrated to unauthorized domains.\n- [PROMPT_INJECTION]: The skill ingests untrusted data through search queries and entry identifiers which could lead to indirect prompt injection.\n
- Ingestion points: query and entry parameters defined in the script arguments.\n
- Boundary markers: The wrapper scripts do not implement explicit delimiters or boundary markers for the user-supplied strings.\n
- Capability inventory: Sub-process execution via spawn and network access through the toolbox server.\n
- Sanitization: The scripts perform basic double-quote escaping for arguments when running on Windows systems.
Audit Metadata