zoowork-managed-agents

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of agents that process external data, which inherently introduces a surface for indirect prompt injection attacks.
  • Ingestion points: Untrusted data enters the agent's context through user.message and system.message events via createSession and postEvents calls, as documented in SKILL.md and references/events-and-streaming.md.
  • Boundary markers: The provided instructions do not specify the use of specific delimiters or boundary markers to distinguish user input from agent instructions, a standard responsibility left to the platform's core model and the developer's specific implementation.
  • Capability inventory: Agents built with this SDK have capabilities including executing shell commands via the exec tool, file system access within a persistent /workspace, and potentially unrestricted network access in the sandbox (detailed in references/deploy-your-agent.md and references/typescript-sdk.md).
  • Sanitization: The skill provides instructions on API usage and does not explicitly require or describe input sanitization, which is consistent with its purpose as a technical SDK reference.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 04:18 AM
Security Audit — agent-trust-hub — zoowork-managed-agents