ble-desk-lamp
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's prerequisite setup instructions in
SKILL.mdutilizenpxto install theble-desk-lamp-pp-clibinary from the@mvanhorn/printing-press-librarypackage. This involves downloading and executing installation logic from the vendor's package repository. - [INDIRECT_PROMPT_INJECTION]: The skill processes telemetry and status data from the desk lamp, creating a surface where an adversarial device could potentially provide malformed data to influence the agent's behavior. Ingestion points: Data is ingested through the
statusandcapabilitiescommands defined ininternal/cli/root.goandinternal/device/transport.go. Boundary markers: The CLI tool supports structured output via the--jsonflag to separate data from instructions. Capability inventory: The skill interacts with the local file system to execute the CLI binary and utilizes thetinygo.org/x/bluetoothlibrary for hardware communication. Sanitization: The underlying Go implementation uses defined hex schemas for payloads and structured mapping for telemetry fields ininternal/device/spec.go.
Audit Metadata