zephyr
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to install the official meta-tool (west) via pip and download the Zephyr SDK from GitHub releases. It also fetches the RTOS source code from official project repositories using west init and update. These are standard procedures for the described use case.
- [COMMAND_EXECUTION]: Provides standard CLI commands for embedded development tasks like building, flashing, and debugging.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external manifest and dependency files, presenting a theoretical attack surface.
- Ingestion points: Manifest and requirement files processed by west and pip (SKILL.md, references/west-manifest.md).
- Boundary markers: Not present.
- Capability inventory: Shell execution for building and dependency management (SKILL.md).
- Sanitization: Not applicable for these developer tools.
Audit Metadata