jev-use
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a loop that processes data from external sources, such as browser DOMs and desktop accessibility trees, which are potential vectors for indirect prompt injection.
- Ingestion points: Accessibility tokens, browser DOM elements, and window state data are ingested through Cua Driver as described in
SKILL.md. - Boundary markers: The skill requires using a "bounded candidate table" and resolving returned IDs against an "original immutable table" to ensure the model cannot invent its own actions.
- Capability inventory: The agent performs computer-use actions via a Driver session based on the selected candidates.
- Sanitization: The instructions explicitly require rejecting unknown, duplicate, or malformed choices and verifying postconditions through an independent task-state oracle rather than relying on model feedback.
Audit Metadata