mine
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
emulo.py) to perform preflight checks, prepare mining plans, and activate generated profiles. These commands are executed via the host's Python interpreter. - [DYNAMIC_EXECUTION]: The skill dynamically resolves the path for
emulo.pyrelative to its own installation directory. It utilizes several subcommands (plugin validate-report,plugin cache-report,plugin validate-pack) to manage the workflow. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local
.jsonlcoding session history files. This presents a vulnerability surface for indirect prompt injection. - Ingestion points: Reads
.jsonlsession history files as source material. - Boundary markers: Uses instructions defined in
MINING_PROMPT.mdand reducer contracts to guide model processing. - Capability inventory: Execution of Python subprocesses for validation, caching, and activation.
- Sanitization: Implements mandatory validation steps (
validate-report,validate-pack) and requires anapproval_hashto ensure the user has reviewed and authorized the execution plan before model work begins.
Audit Metadata