lov-yoda-automation
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill leverages the shell tool to run local scripts (profile_store.py and verify_automation.py) for maintaining user state and validating automation records.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface due to its reliance on external database content. * Ingestion points: verify_automation.py reads title, schedule_label, and error metadata from the automations and automation_runs tables. * Boundary markers: Explicit delimiters or instructions to ignore embedded commands are absent when processing database strings. * Capability inventory: Includes shell access, file read/write, and database read capabilities. * Sanitization: No evidence of escaping or filtering of ingested database content.
- [SAFE]: Several protective measures are implemented: 1. profile_store.py blacklists keys such as 'token', 'secret', and 'password' to avoid accidental exposure of credentials. 2. The script uses atomic replacement and sets restrictive file permissions (0o600) for profile storage. 3. Database interactions for verification are strictly read-only using the mode=ro SQLite flag.
Audit Metadata