tailscale
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides comprehensive and security-focused instructions for managing Tailscale infrastructure, correctly distinguishing between private (Serve) and public (Funnel) exposure and requiring specific checklists for the latter.\n- [SAFE]: Secret management is correctly handled by recommending the
file:prefix for CLI keys and environment variables for containers, preventing credential exposure in shell history or logs.\n- [SAFE]: The skill promotes least-privilege principles using Tailscale 'Grants', tags, and groups, and includes regression testing via policy tests to verify access rules.\n- [INDIRECT_PROMPT_INJECTION]: The skill performs discovery and processing of local project configuration files as part of its core functionality.\n - Ingestion points: The skill searches for and reads local
tailnet*.json,*.hujson, and Kubernetes manifest files via file discovery commands in SKILL.md.\n - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are defined for these local configuration files.\n
- Capability inventory: The skill utilizes shell command execution (Tailscale CLI, kubectl), local file system reads, and Tailscale control-plane mutations via API or CLI.\n
- Sanitization: No explicit sanitization or validation logic is defined for the ingested configuration content within the skill instructions.\n
- Note: This ingestion surface is fundamental to the skill's purpose of managing infrastructure as code and is evaluated as safe given the operational context.
Audit Metadata