doca-pipeline-language-developer-tools
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and processing of external runtime data, creating a surface for indirect prompt injection attacks.\n
- Ingestion points: Runtime state (tables, keys, counters) from DPL Nspect and packet flow data from DPL Debugger.\n
- Boundary markers: Absent; the skill does not define specific delimiters to separate tool output from instructions.\n
- Capability inventory: The skill provides capabilities to modify runtime daemon configuration (DPL Admin) and build custom control-plane applications (DPL Runtime Controller SDK).\n
- Sanitization: Absent; no validation or escaping of external tool output is mandated.\n- [INDIRECT_PROMPT_INJECTION]: The
BENCHMARK.mdfile contains self-referential assertions regarding the skill's safety and performance, such as "Overall verdict: PASS" and "Security: 100.0%". These are evaluated as data and ignored for the purpose of reaching a security conclusion.\n- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill references the DPL Development Container provided via NVIDIA GPU Cloud (NGC). This is documented neutrally as a resource from the well-known vendor (NVIDIA) and does not contribute to verdict escalation.
Audit Metadata