containment
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection and command injection through the interpolation of untrusted data into generated management commands.
- Ingestion points: Untrusted data enters the agent context via parameters in
scripts/containment_utils.pyfunctions, includingip_address,hostname,process_name,username,principal,rule_name, andsender. - Boundary markers: The skill lacks delimiters or warnings to treat these parameters as untrusted data, increasing the risk that malicious input could influence agent behavior.
- Capability inventory: The skill generates commands for high-privilege operations across network devices (iptables), endpoints (taskkill, pkill, systemctl), identity providers (Active Directory and Azure AD PowerShell), and cloud platforms (AWS, Azure, and Google Cloud CLI tools).
- Sanitization: There is no evidence of sanitization, escaping, or validation of these input parameters before they are interpolated into shell command templates (e.g.,
f"iptables -I INPUT -s {ip_address} -j DROP"orf"pkill -9 {process_name}").
Audit Metadata