kermt-monitor
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources including
run.json, log files (pretrain_ddp.log,finetune.log), andtest_result.csvas defined in the workflow ofSKILL.md. - Ingestion points: The skill explicitly reads these files from a user-specified directory to parse workflow metadata, container identifiers, and training progress metrics.
- Boundary markers: No specific delimiters or instructions to ignore embedded commands are defined when interpolating the content of these files into the agent's context.
- Capability inventory: The skill possesses significant system capabilities, including the ability to query and manage Docker containers (
docker ps,docker inspect,docker logs,docker stop,docker rm) and execute filesystem operations viajqandtail(SKILL.md). - Sanitization: The skill does not implement sanitization or strict schema validation for the data read from the manifest or logs. A specific risk is identified where the skill suggests a replay command derived directly from the
cmd_replayfield in therun.jsonfile, which could be exploited for command injection if the file is attacker-controlled.
Audit Metadata