login-2fa-flow
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/preflight.pyutility usessubprocess.runto execute user-provided code commands. This enables verification of local TOTP generation tools before they are used in live login flows, incorporating safety checks for idempotency and execution time.\n- [EXTERNAL_DOWNLOADS]: Thescripts/preflight.pyscript performs a network request to Cloudflare's official domain to check for host clock drift. This diagnostic ensures that the generated TOTP codes are synchronized with network time, which is a requirement for successful authentication.\n- [PROMPT_INJECTION]: The skill explicitly mitigates indirect prompt injection by instructing the agent to verify the origin of the login page before submitting a 2FA code. This check prevents the agent from providing a valid code to a malicious or phished site that has injected a prompt into the automation context.
Audit Metadata