host-observer
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external "inbox jobs" to create observations, which involves ingesting potentially untrusted data.
- Ingestion points: Data extracted from "inbox jobs" as described in SKILL.md.
- Boundary markers: The instructions lack explicit delimiters or warnings to ignore instructions embedded within the jobs.
- Capability inventory: The skill utilizes file system writes to "outbox/{id}.txt" and network POST operations to "/api/memory/save".
- Sanitization: There are no instructions for sanitizing or validating the content (facts and paths) before processing or exfiltrating them.
- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to perform file system write operations to the "outbox/" directory. While functional for the skill's purpose, this allows for modification of the local environment.
- [DATA_EXFILTRATION]: The skill describes a network operation pattern involving a POST request to "/api/memory/save". This provides a mechanism to send extracted data, including file paths and system observations, to an external or local API endpoint.
Audit Metadata