render-env-vars
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch current documentation using
curlor other HTTP clients from official Render domains (https://render.com/docs/configure-environment-variables.mdandhttps://render.com/docs/environment-variables.md). These are well-known official sources for the service configuration. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data by fetching and reading documentation from the web, which could potentially contain malicious instructions if the source were compromised.
- Ingestion points: The
Current documentation retrievalsection inSKILL.mdand references inreferences/environment-variables.mdspecify fetching external Markdown and HTML files. - Boundary markers: There are no explicit boundary markers or delimiters defined to separate the fetched content from the agent's internal instructions.
- Capability inventory: The skill uses network tools (
curl, HTTP clients) to retrieve documentation and tools for environment variable configuration on the Render platform. - Sanitization: The skill does not specify any sanitization or validation of the fetched documentation content before it is processed by the agent.
Audit Metadata