iommu-smmu-isolation
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external system data that could be manipulated by an attacker to influence agent behavior.\n
- Ingestion points: The agent is instructed to read and analyze
dmesglogs and/sys/kernel/iommu_groups/directory metadata as specified inSKILL.mdandevals/README.md.\n - Boundary markers: There are no instructions for using delimiters or boundary markers to distinguish untrusted log content from the agent's instructions.\n
- Capability inventory: The skill instructs the agent to execute shell commands (
python3) to run translation models, providing a vector for command execution if the agent is misled by malicious data in the logs.\n - Sanitization: The instructions do not prescribe any sanitization, escaping, or filtering of the ingested log data before it is processed by the agent.\n- [COMMAND_EXECUTION]: The skill directs the agent to execute local Python scripts to verify IOMMU configurations.\n
- Evidence:
SKILL.mdandevals/README.mdlist shell commands for runningpython3 examples/good/smmu_translation_model.pyandpython3 examples/bad/passthrough_bypass.py. These scripts are local fixtures provided by the vendor.
Audit Metadata