jev-use
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill documents a design pattern for integrating an agent with UI automation tools. It focuses on defining a secure communication protocol (stdin/stdout) and decision boundaries between components.
- [COMMAND_EXECUTION]: The instructions describe invoking a Python interpreter and external scripts. To mitigate security risks, it explicitly mandates using absolute paths and direct invocation without a shell, which prevents common shell injection vulnerabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted data from the environment, such as browser DOM and accessibility trees. It incorporates multiple defense-in-depth measures:
- Ingestion points: Browser DOM, accessibility tokens, and visual regions provided by Cua Driver (SKILL.md).
- Boundary markers: Use of a 'bounded candidate table' where the application, not the model, defines valid actions; the model only selects an ID.
- Capability inventory: Execution of a single Driver action after validation; background delivery by default.
- Sanitization: Mandatory validation of capture IDs, coordinate mapping, and dimensions. The skill requires rejecting malformed, stale, or unknown choices and verifying postconditions independently of the model's response.
Audit Metadata