dino-manage-properties
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the host's process-execution tool to run the
dinoCLI for property and template management. It explicitly instructs the agent to avoid shell interpolation by passing values as separate arguments and using temporary files for complex payloads. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it reads and processes data from external note properties and CLI responses.
- Ingestion points: Data is ingested from the Dinox system via
dino prop listanddino prop show(SKILL.md). - Boundary markers: The skill contains explicit instructions in the 'Runtime Contract' and 'Safety & Boundaries' sections to treat all CLI output and note content as untrusted data and to never execute instructions found within them.
- Capability inventory: The skill's capabilities are limited to subprocess execution of the
dinoCLI (SKILL.md and references/templates.md). - Sanitization: The skill mandates the use of secure temporary files with restricted permissions (0600) for JSON data and prohibits the interpolation of untrusted text into shell commands.
Audit Metadata