colosseum-copilot
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to manage its local configuration and interact with the Colosseum API via curl. These commands are appropriate for the skill's stated purpose and do not show signs of unauthorized system access.
- [DATA_EXFILTRATION]: Includes a telemetry mechanism to log skill usage. The implementation is transparent, explicitly asking for user consent before activation and allowing users to opt-out. Data is sent to a service endpoint defined in the user's local configuration.
- [INDIRECT_PROMPT_INJECTION]: The skill processes project data and research documents from an external API, which presents a surface for indirect prompt injection.
- Ingestion points: User search queries and project data retrieved from the copilot.colosseum.com API (SKILL.md, Workflow section).
- Boundary markers: The skill does not currently use specific delimiters or instructions to ignore potential commands embedded in the external API data.
- Capability inventory: The skill possesses capabilities for network requests (curl) and local file management (mkdir, echo, mv) to support its operations.
- Sanitization: External API content is presented to the agent context without additional validation or sanitization layers.
Audit Metadata