variable-creation
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided inputs such as variable names, default values, and SQL-like formulas to construct API payloads. This represents a surface for indirect injection where malicious data could potentially alter the resulting API request or card definition logic.
- [COMMAND_EXECUTION]: The skill generates shell commands using
curland thecommunity-domo-cli. These commands are designed to interact with the user's specific Domo instance ({instanceUrl}) for legitimate card configuration tasks.
Audit Metadata