upgrade-and-security-readiness-router
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied artifacts including release notes, scanner outputs, and logs, which presents a surface for indirect prompt injection.
- Ingestion points: Artifacts such as scanner findings, release notes, and logs are ingested as evidence in the 'Prerequisites' and 'Workflow Overview' sections of SKILL.md.
- Boundary markers: The skill employs a labeling schema ([supplied], [documented], [observed], [inferred], [unknown]) to distinguish input types, though it lacks explicit technical delimiters like triple backticks for output formatting of untrusted data.
- Capability inventory: Access is restricted to the 'web' tool for Splunk documentation browsing; no capabilities for file modification, system command execution, or credential access are present.
- Sanitization: The instructions explicitly mandate treating external data as evidence only and not as instructions, specifically stating that public fixed versions or scanner paths never prove target environment state or change readiness.
Audit Metadata