cloud-agents-starter
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous instructions for running local development scripts, build processes, and test suites.
- Utilizes
pnpmfor building packages and integrations (e.g.,pnpm build:packages). - Executes development servers for various components like
api-client,api-reference, andcomponents. - Instructs the execution of Python-based integration tests using
python run_tests.py. - Runs a Go-based proxy server using
go run main.go. - [EXTERNAL_DOWNLOADS]: The skill triggers the download of project dependencies via standard package managers.
- Instructs the agent to run
pnpm install, which fetches packages from the public NPM registry. - [INDIRECT_PROMPT_INJECTION]: The skill describes tools designed to ingest and render OpenAPI specifications, which are external data sources that could contain malicious instructions.
- Ingestion points: Tools such as
@scalar/galaxyand@scalar/api-referenceingest OpenAPI documents in JSON or YAML formats from the file system or provided URLs. - Boundary markers: None specified in the runbook instructions to delineate data from commands.
- Capability inventory: The environment includes full shell access via
pnpm, Python execution, and network access for dev servers and E2E tests (Playwright). - Sanitization: Not specified in the skill; relies on the internal parsing logic of the underlying Scalar packages.
Audit Metadata