orca-data-exposure
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses official platform tools to discover security findings related to secrets and PII exposure, which is consistent with its stated intent.
- [COMMAND_EXECUTION]: The skill includes functionality to generate remediation code (Terraform, Ansible, Shell) based on detected risks. This code is written to files for the user to review and deploy.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by retrieving and displaying data from the cloud environment that could be attacker-controlled.
- Ingestion points: Alert titles, asset names, and data snippets retrieved via discovery_search and related MCP tools in SKILL.md.
- Boundary markers: None present for the interpolation of environmental data.
- Capability inventory: Script generation and file-writing capabilities based on environment data.
- Sanitization: The skill does not explicitly specify sanitization of asset names or alert content before they are used in generated reports or file paths.
Audit Metadata