infrahub-managing-objects

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file contains !find shell commands that execute when the skill is loaded. These commands are used to identify existing YAML schema and object files within the project to provide context for the agent. The commands are benign discovery operations and do not include user input interpolation.
  • [INDIRECT_PROMPT_INJECTION]: The skill guides the agent in generating and modifying YAML files that are later processed by the infrahubctl CLI tool. This creates an indirect injection surface if these files were to ingest untrusted data. However, the skill explicitly mitigates this risk by requiring the use of infrahubctl object validate and mandating a branch-first workflow to ensure all changes undergo human review via the platform's proposed-change mechanism.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 10:10 AM