intentional-dependency-choice
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external evidence such as package metadata, recommendations, and tool outputs which are considered untrusted ingestion points (noted in SKILL.md). Malicious instructions embedded in package descriptions could attempt to influence the decision-making process.
- Ingestion points: Processes task material, tool output, and package metadata as evidence during evaluation.
- Boundary markers: Explicitly instructs the agent to delimit untrusted content and leave it unchanged when carried into instructions.
- Capability inventory: Evaluation is restricted to read-only operations; the skill explicitly forbids installing candidates or running their code during evaluation. It mentions using non-mutating checks for evidence gathering.
- Sanitization: Implements an 'Instruction Authority' policy that treats external data as untrusted and requires explicit human approval for any dependency selection or version change.
- [SAFE]: The skill implements several high-standard security practices:
- Credential Safety: Explicitly forbids handling or exposing secret material and directs the agent to use local authentication tools only (Secrets and Authentication section).
- Human-in-the-loop: Requires mandatory, explicit user approval before any choice is finalized or implemented, preventing autonomous dependency installation.
- Least Privilege: Enforces a read-only workflow for the selection process and restricts investigation to public, non-secret information.
Audit Metadata