netbox-custom-objects
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the NetBox API (including Custom Object Types, Fields, and Instances) which could contain malicious instructions if the NetBox instance is compromised. These inputs are used to inform agent actions and command generation.\n
- Ingestion points: Data is fetched via diagnostic curl commands in
SKILL.mdand the REST/GraphQL API workflows described across all reference files.\n - Boundary markers: Absent; the instructions do not define specific delimiters or warnings for the agent when processing data returned from the NetBox API.\n
- Capability inventory: The skill utilizes shell commands (
curl) and provides full CRUD (Create, Read, Update, Delete) capabilities over the NetBox data model.\n - Sanitization: No explicit sanitization or validation of the content of fetched NetBox objects is instructed before processing.\n- [COMMAND_EXECUTION]: Diagnostic commands are provided to verify the status and version of the NetBox plugin using environment variables for authentication.\n
- Evidence:
curl -s -H "Authorization: Bearer $NETBOX_TOKEN" "$NETBOX_URL/api/status/" | python -c ...found inSKILL.md.\n - Context: These commands are used for environment discovery and utilize user-configured variables (
$NETBOX_URL,$NETBOX_TOKEN) in a way that represents standard operational behavior for this vendor's tools.\n- [EXTERNAL_DOWNLOADS]: The skill references the installation of vendor-specific libraries for extended functionality.\n - Evidence: Mentions of
pip install "netboxlabs-netbox-custom-objects[branching]"andpynetboxrequirements.\n - Context: The referenced package
netboxlabs-netbox-custom-objectsbelongs to the author 'netboxlabs' and is documented as a necessary component for the skill's primary purpose.
Audit Metadata