monitor-inbox
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted external data by pulling incoming Pushover notifications into the agent's context. This creates a surface for indirect prompt injection, where a malicious notification could attempt to override the agent's instructions.
- Ingestion points: The
pullcommand fetches messages from the Pushover Open Client API and appends them to a local JSONL file in~/.local/state/pushover/. - Boundary markers: The skill instructions do not define specific delimiters or warnings to treat the fetched notification content as untrusted data.
- Capability inventory: The agent can execute local TypeScript code via
bun, write to the local file system, and update its own skill definition. - Sanitization: There is no evidence of content filtering or sanitization of the message payload before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill executes a local TypeScript library script (
_lib/pushover_inbox.ts) using thebunruntime to perform its core operations, including network requests and local state management.
Audit Metadata