internal-lab-validation
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides operational guidelines for vulnerability validation in private lab environments. It strictly enforces the use of internal IP ranges (RFC1918) and loopback addresses, explicitly prohibiting scans against client or third-party infrastructure.
- [COMMAND_EXECUTION]: The skill workflow involves executing a local Python-based scanner (
lab-scan.py) and environment management commands (e.g.,pct exec). These are standard operations for the skill's primary purpose of security baselines and lab maintenance. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates an ingestion surface for untrusted data as it processes scan results such as
report.mdandfindings.json. - Ingestion points: Analyzes output from
lab-scan.pylocated inreport.mdandfindings.json(referenced in SKILL.md). - Boundary markers: Not explicitly defined in the provided file.
- Capability inventory: Execution of Python scripts and Proxmox container commands (
pct exec) (referenced in SKILL.md). - Sanitization: Rule 5 explicitly mandates the sanitization of artifacts and test credentials, preventing the inclusion of sensitive client data.
Audit Metadata