skypilot-multi-cloud-orchestration
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to facilitate the execution of shell commands on remote cloud infrastructure. Agent instructions include examples for running arbitrary commands within setup and run blocks of SkyPilot YAML configurations, which are executed via the sky launch and sky exec CLI tools.
- [EXTERNAL_DOWNLOADS]: The skill utilizes external resources, including the skypilot Python package and its dependencies, which are installed via standard package managers. It also supports fetching data and code from remote Git repositories and cloud storage providers (AWS S3, Google Cloud Storage, Azure Blob Storage) to be mounted or copied onto orchestrated clusters. All official project links point to the verified SkyPilot organization on GitHub.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes external, potentially untrusted data that could influence the agent's behavior. 1. Ingestion points: Remote storage buckets (S3/GCS) specified in file_mounts, remote Git repositories in workdir, and external environment variables. 2. Boundary markers: The provided instructions do not include specific delimiters or 'ignore' directives to prevent the agent from processing malicious instructions that might be embedded in the content of these external files. 3. Capability inventory: The skill allows for network access to cloud providers and execution of shell commands on provisioned infrastructure. 4. Sanitization: There is no logic for sanitizing or validating the content retrieved from remote sources before it is used in the orchestration process.
Audit Metadata