implementing-hashicorp-vault-dynamic-secrets

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the hvac Python library, which is a well-known and widely used client for interacting with the HashiCorp Vault API.
  • [COMMAND_EXECUTION]: The skill provides CLI functionality for secret lifecycle management via scripts/agent.py and administrative shell commands in SKILL.md for Vault configuration and audit log analysis.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, creating an ingestion surface for potential instructions embedded in tool outputs.
  • Ingestion points: Vault API responses (health status, mount lists, and authentication methods) in scripts/agent.py and system audit log files in the audit monitoring script.
  • Boundary markers: Not explicitly defined in the processing logic for external tool output.
  • Capability inventory: File system writes for reporting, console output, and Vault lease operations (renewal and revocation).
  • Sanitization: Employs jq for structured log parsing and json.dump for data serialization in Python, providing basic structural validation of the processed information.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 01:11 AM