object-fields

Pass

Audited by Gen Agent Trust Hub on Apr 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents the use of the !!js/function YAML tag in field definitions to allow for JavaScript-based formula calculations at runtime.
  • Evidence: SKILL.md includes an example of a formula field using !!js/function to define logic.
  • [COMMAND_EXECUTION]: The documentation describes Amis UI customization options, such as requestAdaptor and adaptor, which involve embedding JavaScript snippets to process data for the UI.
  • Evidence: SKILL.md provides an example of amis configuration with embedded JavaScript code for data adaptation and GraphQL interaction.
  • [PROMPT_INJECTION]: The skill describes a surface for indirect prompt injection where user requirements for field definitions could lead to the generation of executable logic in formulas or UI customizations.
  • Ingestion points: User requirements for object and field definitions entering the agent context (referenced in SKILL.md).
  • Boundary markers: Absent; there are no instructions for delimiting or isolating user-provided logic within the generated formulas or adaptors.
  • Capability inventory: Generation of YAML configuration files containing JavaScript logic (formula, amis adaptors).
  • Sanitization: No sanitization or validation of the generated logic is described in the documentation examples.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 23, 2026, 03:02 AM
Security Audit — agent-trust-hub — object-fields