zoowork-managed-agents
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of agents that process external data, which inherently introduces a surface for indirect prompt injection attacks.
- Ingestion points: Untrusted data enters the agent's context through
user.messageandsystem.messageevents viacreateSessionandpostEventscalls, as documented inSKILL.mdandreferences/events-and-streaming.md. - Boundary markers: The provided instructions do not specify the use of specific delimiters or boundary markers to distinguish user input from agent instructions, a standard responsibility left to the platform's core model and the developer's specific implementation.
- Capability inventory: Agents built with this SDK have capabilities including executing shell commands via the
exectool, file system access within a persistent/workspace, and potentially unrestricted network access in the sandbox (detailed inreferences/deploy-your-agent.mdandreferences/typescript-sdk.md). - Sanitization: The skill provides instructions on API usage and does not explicitly require or describe input sanitization, which is consistent with its purpose as a technical SDK reference.
Audit Metadata