skills/rade-nugroho/agentic-enteprises-skill/classified-software-devsecops-engineer/Gen Agent Trust Hub
classified-software-devsecops-engineer
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows security best practices for air-gapped and classified environments, specifically advising against hardcoded secrets and advocating for short-lived credentials and non-root execution. All architectural recommendations focus on hardening the delivery pipeline.
- [INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risks of processing external data, such as code commits and agent-generated content, and mandates that such inputs be treated as untrusted and scanned. This mitigates the potential for indirect prompt injection within the delivery pipeline. 1. Ingestion points: Git commits, PRs, and third-party dependency bundles are identified as external data sources in references/security_gates_and_supply_chain.md and references/cleared_pipelines_and_environments.md. 2. Boundary markers: Explicit instructions in references/security_gates_and_supply_chain.md state to treat agent output as untrusted until scanned. 3. Capability inventory: The agent is guided to use CI/CD tools, infrastructure-as-code (Terraform), and container orchestration (Kubernetes) to manage secure delivery. 4. Sanitization: The skill requires SAST, SCA, and container scans, along with OPA/Gatekeeper admission policies, to validate all ingested and produced artifacts.
Audit Metadata