army-join
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill is composed entirely of markdown documentation and JSON evaluation files. It does not include any Python scripts, Node.js code, shell scripts, or executable binaries.
- [SAFE]: The provided documentation outlines security best practices, including the use of single-use expiring tokens and strict capability separation to prevent external entities from bypassing system controls.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a mechanism for ingesting data from external, untrusted sessions. It explicitly incorporates architectural safeguards to mitigate the risk of indirect prompt injection.
- Ingestion points: External data is ingested through a result endpoint (
/api/join/<token>/result) defined in the context package. - Boundary markers: The documentation specifies that external output is 'fenced as data' when presented to other agents, preventing it from being interpreted as instructions.
- Capability inventory: The skill itself defines no executable capabilities or tools; it is purely a protocol definition.
- Sanitization: It enforces that 'the ability to message is not reachable from the ability to approve,' ensuring that untrusted data cannot be used to authorize actions.
Audit Metadata