skills/netboxlabs/skills/netbox-diode/Gen Agent Trust Hub

netbox-diode

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the netboxlabs-diode-sdk (Python) and the github.com/netboxlabs/diode-sdk-go (Go) library. These are official SDKs provided by the skill's author, NetBox Labs, and are hosted on standard registries and repositories.
  • [COMMAND_EXECUTION]: The skill references the use of the diode-replay-dryrun command-line utility for testing ingestion files and uses standard package management commands like pip install and go get for setup.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from external network discovery tools, bulk imports, and automated population scripts to update NetBox records. This defines a vulnerability surface where malicious input from a compromised discovery source could attempt to influence NetBox data.
  • Ingestion points: Data objects constructed in Python or Go scripts and passed to the Diode client (SKILL.md, python-sdk-guide.md, go-sdk-guide.md).
  • Boundary markers: No explicit markers are defined in the code samples, as the data is handled as structured SDK objects rather than free-form text prompts.
  • Capability inventory: Performs network operations to send data to a NetBox Diode server via gRPC (client.ingest).
  • Sanitization: Relies on the server-side NetBox Diode reconciler to validate and match ingested data against the NetBox schema.
  • [CREDENTIALS_UNSAFE]: The skill recommends using environment variables (DIODE_CLIENT_ID and DIODE_CLIENT_SECRET) to manage OAuth2 credentials, which aligns with security best practices for secret management. It avoids hardcoding secrets in the provided code examples.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 08:22 PM