aas-compose-stack
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the AAS catalog and project files which may contain embedded instructions.
- Ingestion points: The agent reads the AAS catalog and supporting files to identify project capabilities.
- Boundary markers: The skill includes instructions to treat catalog content as untrusted task content and states they do not grant permission or override platform safeguards.
- Capability inventory: Tools including compose_stack, inspect_stack, export_selection_evidence, and the runtime/aas-core.cjs CLI are present.
- Sanitization: Instructions specify never to include secrets or unnecessary file contents when exporting evidence.
- [COMMAND_EXECUTION]: The skill explicitly triggers local processes for evidence gathering.
- Evidence: SKILL.md notes that evidence calls run in a process on the user's computer via the export_selection_evidence tool.
- [DYNAMIC_EXECUTION]: The skill depends on a bundled JavaScript file for local operations.
- Evidence: SKILL.md references the bundled runtime runtime/aas-core.cjs for filesystem planning.
Audit Metadata