backup-restore-runbook-generator
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill generates shell scripts that ingest untrusted data via command-line arguments and process external files, creating a surface for indirect prompt injection.\n
- Ingestion points:
restore-postgres.sh(takes$1as a backup filename),pitr-restore.sh(takes$1as a target time), andvalidate-restore.sh(takes$1as a database name).\n - Boundary markers: None identified; the scripts lack delimiters or warnings regarding embedded instructions in the metadata or filenames of processed backups.\n
- Capability inventory: The scripts possess high-privilege capabilities including database restoration (
pg_restore), system service management (systemctl), Kubernetes cluster management (kubectl), and cloud infrastructure provisioning (aws rds).\n - Sanitization: There is no evidence of input validation, escaping, or filtering for the provided arguments before they are used in shell commands.\n- [COMMAND_EXECUTION]: The skill instructions and scripts perform numerous system-level command executions, including
systemctl start,kubectl scale, and various AWS CLI operations (aws rds create-db-instance). While these are aligned with the skill's purpose for disaster recovery, they represent a significant capability tier.\n- [EXTERNAL_DOWNLOADS]: The monitoring scriptmonitor-backups.tsreferences the@aws-sdk/client-s3Node.js package. This is an official package from a well-known service provider used for the skill's intended monitoring functionality.
Audit Metadata