spatial-sdk-update
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands including local file system operations (
ls,cat), vendor-specific CLI tools (pico-cli), and project build scripts (./gradlew build). These operations are used to discover SDK versions, pull development knowledge, and verify project builds. - [EXTERNAL_DOWNLOADS]: The agent is directed to download and install external components such as PICO development knowledge and the PICO Spatial Editor using the
pico-clitool (e.g.,pico-cli knowledge pullandpico-cli editor install). These are vendor-provided resources associated with the skill's primary purpose. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes untrusted data from project files.
- Ingestion points: The skill reads
gradle/libs.versions.toml,build.gradle.kts,AndroidManifest.xml, and local Maven metadata files (maven-metadata.xml). - Boundary markers: There are no explicit instructions or delimiters mentioned to prevent the agent from following instructions potentially embedded in these project files.
- Capability inventory: The skill has capabilities to execute shell commands (
pico-cli,gradlew), perform file system writes (modifying project files and.pico-env.json), and invoke MCP tools (switch_workspace). - Sanitization: No sanitization or validation steps are defined for the content extracted from external project files before it is processed by the agent.
Audit Metadata