setup-rstack
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes model identifiers discovered from the host environment and reads from a local configuration file (
~/.config/rstack/models.md). - Ingestion points: The skill reads existing configuration from
~/.config/rstack/models.mdand discovers identifiers through the host's supported model listing or delegation interface. - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the discovered model identifiers as untrusted data or to ignore embedded instructions within them.
- Capability inventory: The skill is capable of reading from and writing to the file system (
~/.config/rstack/models.md). - Sanitization: There is no mention of sanitizing or validating the model identifiers before they are written to the configuration file or used in future prompts.
Audit Metadata