cua-capability-dispatch
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill directs the agent to file bug reports to the vendor repository automatically, bypassing confirmation steps for each report.
- [DATA_EXFILTRATION]: The skill transmits diagnostic logs and issues to an external GitHub repository; instructions require the agent to sanitize all credentials and private content before transmission.
- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (gh) and runs specialized worker scripts for UI analysis and visual observation.
- [DYNAMIC_EXECUTION]: Subprocesses are launched using command-line arguments retrieved from environment variables or local JSON configuration, executing local scripts based on user settings.
- [EXTERNAL_DOWNLOADS]: Installation involves cloning vendor-owned repositories and executing setup scripts and tests.
- [INDIRECT_PROMPT_INJECTION]: The skill processes live UI snapshots, accessibility data, and terminal output, which serves as an ingestion point for untrusted external data.
- Ingestion points: UI observations, terminal output, accessibility trees.
- Boundary markers: Employs evidence-based dispatch logic but lacks explicit markers to differentiate between instructions and UI data.
- Capability inventory: File access, network communication, and subprocess execution.
- Sanitization: Strong requirements for removing sensitive data before external submission to GitHub.
Audit Metadata