pbvex-operations
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines procedures for processing configuration files and migrations that influence the execution of build and deployment tools. If these files are manipulated by an attacker, they could potentially influence the agent's actions during the deployment workflow.
- Ingestion points:
pbvex/pbvex.config.tsandpbvex/migrations/*.ts(found in SKILL.md). - Boundary markers: None observed in the instructions.
- Capability inventory: Execution of
npx,pnpm,go,curl, and local shell scripts like./scripts/release-validate.sh(found in SKILL.md). - Sanitization: The instructions do not explicitly mention sanitization or validation for the content of the migration or configuration files.
- [COMMAND_EXECUTION]: The skill provides instructions to execute several command-line tools for application lifecycle management and CI/CD workflows.
- Evidence: Includes commands for
npx pbvex,pnpm build,go build, and local script execution (./scripts/release-validate.sh,node scripts/stage-server-binaries.mjs) for release automation (found in SKILL.md).
Audit Metadata