lambda-lang
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents a protocol for processing external agent-to-agent messages, which represents a potential attack surface for indirect prompt injection if implemented without proper validation. * Ingestion points: Multi-agent messaging pipelines, orchestrators, and task delegation channels as described in SKILL.md. * Boundary markers: The 'Security & Safety Notes' section explicitly warns developers to treat every received Lambda message as untrusted input, regardless of apparent validity. * Capability inventory: None. The skill contains documentation only and does not provide tools for file system access, network operations, or shell execution. * Sanitization: The instructions mandate validating negotiated versions, schemas, and sender identities, as well as escaping payloads for downstream systems.
- [NO_CODE]: The skill contains no executable scripts, binaries, or active platform tool definitions. It functions purely as a reference guide for a communication syntax.
Audit Metadata