netbox-validation
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard shell commands (
curl,python) to interact with the NetBox Validation REST API. These commands facilitate policy creation, validation run execution, and the retrieval of compliance findings using environment variables for sensitive configuration. - [DYNAMIC_EXECUTION]: The skill includes examples of executing small Python scripts via the
-cflag and thejson.toolmodule to parse and format API responses. These are standard techniques for processing structured data in a command-line environment. - [INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting and processing data from a remote NetBox instance, which creates an attack surface for indirect prompt injection if the source data is compromised.
- Ingestion points: Data is retrieved from various API endpoints including
/api/plugins/validation/findings/,/results/, and/policies/viacurlcommands. - Boundary markers: The instructions do not define specific delimiters or warnings to separate retrieved data from the agent's instructions.
- Capability inventory: The skill allows the agent to perform network requests to the NetBox API, manage validation policies, and execute Python scripts for data parsing.
- Sanitization: There are no explicit instructions for sanitizing or escaping the content retrieved from the API before the agent processes it.
Audit Metadata