rolecard-workshop-ops
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface by ingesting and processing untrusted external data while possessing deployment capabilities.
- Ingestion points: The skill reads package detail responses, moderation queues, public index data, and service logs (SKILL.md, architecture-and-contracts.md).
- Boundary markers: The instructions mandate redacting sensitive headers and credentials from logs, but do not provide explicit delimiters or "ignore instructions" directives for data parsed from packages (SKILL.md).
- Capability inventory: The skill has the capability to execute user-defined shell commands via
DEPLOY_COMMANDandVERIFY_COMMAND(operations-and-security.md). - Sanitization: It requires that imported packages pass schema, compatibility, and policy checks, and that logs be redacted, which partially mitigates but does not eliminate the risk of an attacker embedding malicious instructions within the package metadata or log entries (SKILL.md).
Audit Metadata