doca-pcc
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONOBFUSCATION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill instructs the agent to execute
dmesgusingsudofor driver debugging and notes that access to hardware devices (doca_dev) typically requires elevated privileges. - [COMMAND_EXECUTION]: Instructions guide the agent to run various system commands for environment discovery and building, including
pkg-config,doca_caps,ls, anddmesg. - [INDIRECT_PROMPT_INJECTION]: The skill has the agent ingest data from system command outputs and local files (e.g., sample code in
/opt/mellanox/doca/), creating a surface for indirect prompt injection if those sources contain malicious instructions. - Ingestion points: Command outputs from
dmesg,pkg-config, anddoca_caps; local files in/opt/mellanox/doca/(TASKS.md). - Boundary markers: None explicitly defined for untrusted command output.
- Capability inventory: Subprocess calls for
pkg-config,doca_caps,dmesg,ls, andwhich(TASKS.md). - Sanitization: None described for external command output.
- [OBFUSCATION]: The skill includes an artifact signature file (
skill.oms.sig) containing a Base64-encoded payload that embeds internal URLs not visible in plain-text scanning.
Audit Metadata