xiao-edgeimpulse-train
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses local project files (datasets) and environment configuration (".env") to retrieve API keys. This data is transmitted to the Edge Impulse ingestion and studio APIs as part of the model training process. This behavior is documented and necessary for the skill's primary function.
- [COMMAND_EXECUTION]: System-level commands are used for API communication via "curl.exe" and for managing the Arduino development environment using "arduino-cli", including library installation and model compilation.
- [EXTERNAL_DOWNLOADS]: The skill downloads compiled Arduino library archives from the official Edge Impulse studio API. This is a standard part of the model deployment workflow for the target hardware.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by processing external data.
- Ingestion points: Dataset files and labels are read from the local file system in Step 1.
- Boundary markers: No specific delimiters are defined for filtering instructions within dataset metadata or content.
- Capability inventory: The skill possesses capabilities for network transmission and shell command execution.
- Sanitization: The instructions do not explicitly mandate sanitization of file labels or metadata before processing.
Audit Metadata