netbox-validation

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes standard shell commands (curl, python) to interact with the NetBox Validation REST API. These commands facilitate policy creation, validation run execution, and the retrieval of compliance findings using environment variables for sensitive configuration.
  • [DYNAMIC_EXECUTION]: The skill includes examples of executing small Python scripts via the -c flag and the json.tool module to parse and format API responses. These are standard techniques for processing structured data in a command-line environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting and processing data from a remote NetBox instance, which creates an attack surface for indirect prompt injection if the source data is compromised.
  • Ingestion points: Data is retrieved from various API endpoints including /api/plugins/validation/findings/, /results/, and /policies/ via curl commands.
  • Boundary markers: The instructions do not define specific delimiters or warnings to separate retrieved data from the agent's instructions.
  • Capability inventory: The skill allows the agent to perform network requests to the NetBox API, manage validation policies, and execute Python scripts for data parsing.
  • Sanitization: There are no explicit instructions for sanitizing or escaping the content retrieved from the API before the agent processes it.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 08:27 PM