orca-config-origin
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs legitimate security investigation tasks by tracing cloud alert origins through audit logs and asset metadata. All tool calls (e.g., get_alert, search_cdr_events) and data access patterns align with the stated purpose of resource attribution.
- [DATA_EXPOSURE]: While the skill accesses cloud metadata and audit logs, it does so through approved platform tools to fulfill its primary function. No evidence was found of data exfiltration to external or untrusted domains.
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data from external sources. Ingestion points: Data enters the context via get_alert, get_asset_by_id, and search_cdr_events (specifically asset tags, CodeOrigins snippets, and log entries). Boundary markers: No explicit delimiters or instructions are provided to the agent to treat this data as untrusted. Capability inventory: No dangerous capabilities such as subprocess execution, eval, file writing, or direct network operations are present in the skill instructions. Sanitization: No specific sanitization or filtering of external data is performed before processing.
Audit Metadata