trigger-dev
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch live documentation from https://trigger.dev/llms.txt and https://trigger.dev/docs/llms-full.txt. These resources originate from the official domain of a well-known service (Trigger.dev).
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an ingestion point for external data by requiring the agent to fetch and process the contents of external text files, which could theoretically contain instructions intended for the agent.
- Ingestion points: SKILL.md instructs the agent to use WebFetch on external documentation URLs.
- Boundary markers: None specified in the instructions for the fetched content.
- Capability inventory: The skill provides instructions for task definitions and mentions NPM packages but does not include executable scripts; capability is limited to the agent's native tools.
- Sanitization: No specific sanitization or validation of the fetched content is mentioned.
Audit Metadata