oodle
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: No malicious patterns or critical security risks were identified. The skill instructions follow prescriptive safety guidelines, emphasizing user confirmation for destructive actions and strict data sanitization rules.\n- [PROMPT_INJECTION]: The
oodle-onboardingskill (inskills/oodle-onboarding/SKILL.md) exhibits an indirect prompt injection surface by processing remote integration setup specifications to execute commands. \n - Ingestion points: Fetches setup specifications from the Oodle API via
oodle integrations get-setup-spec <type>.\n - Boundary markers: Mitigated by instructions requiring the agent to display the command and obtain explicit user confirmation before every execution.\n
- Capability inventory: Allows execution of shell commands such as
kubectl,helm, and other platform configuration tools.\n - Sanitization: Prescriptive rules are included for redacting API keys and sensitive tokens before displaying commands or configurations to the user.\n- [EXTERNAL_DOWNLOADS]: The skill documentation guides the installation of the
oodleCLI tool and agent skills using official package managers (Homebrew, Go, npx) and vendor-owned repositories (github.com/oodle-ai/*). These downloads are verified to originate from official vendor infrastructure.
Audit Metadata