auri-core
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documentation describes an architecture that ingests untrusted user data which could influence agent behavior.
- Ingestion points: User speech is captured via the
queryslot (AMAZON.SearchQuery) and passed directly to the model context inhandlers/conversation.py. - Boundary markers: The provided description does not include specific delimiting markers or system instructions to ignore potential commands embedded within the user's speech query.
- Capability inventory: The skill possesses the capability to write to DynamoDB (auri-user-memory) and perform network operations via the Anthropic Claude API.
- Sanitization: There is no evidence of input validation or sanitization described in the Lambda handler logic before user input is interpolated into the message history.
- [REMOTE_CODE_EXECUTION]: The skill mentions standard deployment patterns using AWS SAM (
sam build,sam deploy) and dependencies on well-known, official libraries. These are documented as part of the intended development workflow and do not constitute a security risk. - [DATA_EXFILTRATION]: While the skill interacts with external APIs (Anthropic Claude API) and AWS services (DynamoDB, Polly), these are legitimate components of the described product and do not show patterns of unauthorized data exfiltration.
Audit Metadata