platform-cli
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the management of machine learning projects and cloud training runs through the execution of
ulandul cloudCLI commands. - [EXTERNAL_DOWNLOADS]: Fetches the official OpenAPI specification from
https://platform.ultralytics.com/openapi.json. This download targets a vendor-owned domain to provide the agent with current API request structures. - [REMOTE_CODE_EXECUTION]: Scanners detected a command pattern where remote content is piped to
python3. Detailed review shows this is a benign operation (curl ... | python3 -c "...") that uses a static, local Python script to parse JSON data from a vendor-owned source rather than executing arbitrary remote code. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user inputs and local files (via
@fileand@pathsyntax) which is interpolated into shell commands. This represents a standard capability for a CLI wrapper, though it defines a surface for potential indirect prompt injection. - [SAFE]: All identified Python packages (
ultralytics,ultralytics-platform) and external domains (ultralytics.com) are official resources belonging to the skill's author.
Audit Metadata