inspect-content-provenance
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a defensive utility designed to identify and report provenance markers and steganographic covert channels. It processes untrusted input using structural inspection and character analysis rather than executing the content.
- [DYNAMIC_EXECUTION]: The core logic contains utility functions for executing an external provenance verifier (c2patool). This execution is performed using security best practices, specifically shell=False and argument list construction, to mitigate injection risks. These functions are currently not activated in the primary inspection script.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted files and text to identify provenance signals. While this creates an ingestion surface for potentially deceptive content, the skill is explicitly designed to detect and inventory hidden markers that characterize such attacks, and the instructions direct the agent to maintain a neutral, unverified stance towards the results.
Audit Metadata