object-fields
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of the
!!js/functionYAML tag in field definitions to allow for JavaScript-based formula calculations at runtime. - Evidence:
SKILL.mdincludes an example of aformulafield using!!js/functionto define logic. - [COMMAND_EXECUTION]: The documentation describes Amis UI customization options, such as
requestAdaptorandadaptor, which involve embedding JavaScript snippets to process data for the UI. - Evidence:
SKILL.mdprovides an example ofamisconfiguration with embedded JavaScript code for data adaptation and GraphQL interaction. - [PROMPT_INJECTION]: The skill describes a surface for indirect prompt injection where user requirements for field definitions could lead to the generation of executable logic in formulas or UI customizations.
- Ingestion points: User requirements for object and field definitions entering the agent context (referenced in
SKILL.md). - Boundary markers: Absent; there are no instructions for delimiting or isolating user-provided logic within the generated formulas or adaptors.
- Capability inventory: Generation of YAML configuration files containing JavaScript logic (
formula,amisadaptors). - Sanitization: No sanitization or validation of the generated logic is described in the documentation examples.
Audit Metadata