netbox-diode
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the
netboxlabs-diode-sdk(Python) and thegithub.com/netboxlabs/diode-sdk-go(Go) library. These are official SDKs provided by the skill's author, NetBox Labs, and are hosted on standard registries and repositories. - [COMMAND_EXECUTION]: The skill references the use of the
diode-replay-dryruncommand-line utility for testing ingestion files and uses standard package management commands likepip installandgo getfor setup. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from external network discovery tools, bulk imports, and automated population scripts to update NetBox records. This defines a vulnerability surface where malicious input from a compromised discovery source could attempt to influence NetBox data.
- Ingestion points: Data objects constructed in Python or Go scripts and passed to the Diode client (SKILL.md, python-sdk-guide.md, go-sdk-guide.md).
- Boundary markers: No explicit markers are defined in the code samples, as the data is handled as structured SDK objects rather than free-form text prompts.
- Capability inventory: Performs network operations to send data to a NetBox Diode server via gRPC (
client.ingest). - Sanitization: Relies on the server-side NetBox Diode reconciler to validate and match ingested data against the NetBox schema.
- [CREDENTIALS_UNSAFE]: The skill recommends using environment variables (
DIODE_CLIENT_IDandDIODE_CLIENT_SECRET) to manage OAuth2 credentials, which aligns with security best practices for secret management. It avoids hardcoding secrets in the provided code examples.
Audit Metadata