lookout-companion
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill involves processing and displaying output from external sources like build logs and git commands.
- Ingestion points: Data from build/test execution, git operation status, and subagent findings (SKILL.md).
- Boundary markers: None identified for the visualization card content.
- Capability inventory: Visual output tools (show_text, show_table, show_log) for rendering data in a TUI.
- Sanitization: Explicitly prohibits pushing secrets, credentials, or .env file contents to the visualizer.
- [SAFE]: The skill communicates with a local service on 127.0.0.1, which is a whitelisted loopback address for local developer tools. It adheres to best practices by explicitly instructing the agent to filter out sensitive credentials.
Audit Metadata