tao-generate-referring-expressions
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes untrusted external data (images and text-based label files) which are then interpreted by a Vision-Language Model (VLM).
- Ingestion points: The skill reads images from
data.image_dirand KITTI-format label files fromdata.kitti_label_dir(referenced inSKILL.mdandreferences/configuration.md). - Boundary markers: The documentation does not specify the use of delimiters or 'ignore' instructions to prevent the VLM from following commands embedded within images (OCR-based injection) or label text.
- Capability inventory: The skill executes the
auto_labelCLI tool within a Docker container and performs network operations to external VLM endpoints (Gemini or OpenAI-compatible APIs). - Sanitization: There is no evidence of sanitization or validation of the contents of the image or label files prior to processing by the VLM.
Audit Metadata