Skills
Navigate
skills/ravnhq/ai-toolkit/qa-chaos-monkey/Gen Agent Trust Hub

qa-chaos-monkey

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [DATA_EXFILTRATION]: The skill reads local environment files to obtain necessary secrets for testing purposes. Evidence: Instructions in SKILL.md and rules/std-test-plan.md direct the agent to retrieve QA_API_URL and SIGNING_SECRET from .env.qa.
  • [COMMAND_EXECUTION]: The skill employs shell commands to handle cryptographic signing of requests. Evidence: SKILL.md contains bash templates for HMAC-SHA256 generation using openssl.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted test plans which could contain malicious instructions. Ingestion points: Reads .qa/test-plan.md and .qa/config.yml. Boundary markers: None present. Capability inventory: Access to Bash and network tools. Sanitization: None.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 03:01 AM