build-agent-broker-project
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses official vendor CLI tools such as anypoint-cli-v4 and the anypoint-cli-agent-fabric-plugin to perform project management tasks like scaffolding, validation, and deployment. These are legitimate operations within the context of the skill's stated purpose.
- [EXTERNAL_DOWNLOADS]: The instructions recommend installing official MuleSoft packages from the NPM registry to enable CLI functionality.
- [CREDENTIALS_UNSAFE]: Secret management follows industry best practices by utilizing environment variables (e.g., ANYPOINT_CLIENT_ID) and parameterization in configuration files. The instructions explicitly forbid hardcoding or exposing credentials and provide guidance on secure authentication.
- [PROMPT_INJECTION]: The skill contains a 'HARD OUTPUT CONTRACT' and 'FORBIDDEN' content/openings to strictly control the AI's response format and user experience. These are legitimate steering instructions intended to maintain a specific interface and do not attempt to bypass safety guidelines or extract system prompts.
Audit Metadata