qemu-peripheral-modeling
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it instructs the agent to process data from untrusted external sources like hardware documentation.
- Ingestion points: External datasheets, SDK drivers, firmware traces, and register specification files (as described in the 'Workflow' and 'Device modeling contract' sections of SKILL.md).
- Boundary markers: Absent. The instructions do not require the agent to use specific delimiters or to ignore potential instructions embedded within the technical documents.
- Capability inventory: The agent can write source code, create and execute temporary scripts, run shell commands for building QEMU, and perform git operations.
- Sanitization: Absent. There are no requirements to validate or sanitize external document content before modeling.
- [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to manage the workspace and verify modeling accuracy.
- Evidence: The agent is directed to run commands such as
git status,git rev-parse --git-path info/exclude, and system build tools for QEMU. While these are legitimate activities for the skill's purpose, they represent a capability that could be targeted by injection from the ingested external data.
Audit Metadata