opentrons-app
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
ocu(Open Computer Use) tool to automate desktop interactions and retrieve application status as described in the Core Workflow of SKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes text from the Opentrons App, which can include content from user-provided protocol files.
- Ingestion points: The
get_app_statetool reads GUI text and accessibility metadata (SKILL.md). - Boundary markers: The skill relies on 'Safety boundary' instructions requiring user approval for consequential actions, but lacks technical delimiters to escape or isolate external text.
- Capability inventory: The skill can execute commands to move robot hardware, calibrate instruments, and start laboratory protocols via UI automation.
- Sanitization: No evidence of sanitization or character escaping for data extracted from the application interface.
Audit Metadata