roofline-toolcall-ru
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes the configuration of tool-calling mechanisms which process external data from tool outputs, creating a known surface for indirect prompt injection.\n
- Ingestion points: Data returned from executed tools, as described in the Security section of SKILL.md.\n
- Boundary markers: The skill explicitly warns that inference engines (vLLM/SGLang) do not filter tool results and recommends implementing security boundaries at the client or proxy level.\n
- Capability inventory: The agents intended to use this configuration (e.g., Claude Code, Qwen Code) typically possess significant capabilities, including file system access and shell command execution.\n
- Sanitization: The skill advises mitigations such as using tool allowlists and requiring user confirmation for destructive actions, rather than relying on the model to filter malicious tool output.
Audit Metadata