patch-prioritization
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill references and fetches data from established, trusted security organizations. It uses the EPSS API (api.first.org) and the CISA KEV catalog (cisa.gov) to enrich vulnerability data, which are industry-standard resources for threat intelligence and risk assessment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as vulnerability scan reports, ticket descriptions, and CVE metadata. While this represents a potential attack surface, the risk is mitigated by strong instructional guardrails.
- Ingestion points: The skill reads vulnerability inventory data, scanner source inputs, and external advisory text.
- Boundary markers: The skill lacks technical delimiters for input data but includes a specific 'Prompt Injection Safety Notice' instructing the agent to disregard any instructions embedded in the external content (e.g., attempts to manipulate SLA tiers).
- Capability inventory: The skill is restricted to read-only operations via the 'Read', 'Grep', and 'Glob' tools. It does not have permissions to execute code, write files, or perform arbitrary network requests.
- Sanitization: Relies on the agent's behavioral logic to identify and ignore suspicious commands within the analyzed data.
Audit Metadata