setup-k8s-backend
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes output from Observe CLI commands which represents an attack surface for instructions embedded in external data.
- Ingestion points: Data is ingested from commands like
observe auth status,observe datastream list, andobserve content viewinSKILL.md. - Boundary markers: The skill defines a mandatory
wraphelper inreferences/untrusted-output.mdthat uses per-read random nonces to create secure<untrusted-data>tags. - Capability inventory: The skill possesses capabilities to create and configure datastreams, content packages, and ingest tokens via the
observeCLI. - Sanitization: The
wraphelper includes sanitization logic usingsedandtrto neutralize terminal escape sequences and non-printable characters that could be used to spoof delimiters. - [COMMAND_EXECUTION]: The skill instructs the user to execute
observeCLI commands and shell scripts involvingjq,openssl, and text processing utilities to manage tenant state. - [DATA_EXFILTRATION]: The workflow for creating ingest tokens in Phase 3d is explicitly designed to keep the secret value within the user's local shell environment while stripping it from the JSON metadata provided back to the assistant, preventing accidental data exposure.
Audit Metadata