agent-integration
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes source code and configuration files from external repositories to generate Veris integration files. Ingestion points: Reads repository files such as Dockerfiles, package manifests, and entrypoint code (SKILL.md Phase 1). Boundary markers: Absent in the instructions for parsing repository content. Capability inventory: The skill is capable of installing CLI tools, creating files, and executing environment deployment commands (SKILL.md Phase 0, 6). Sanitization: The instructions do not specify validation or sanitization of the content extracted from the repository files.
- [EXTERNAL_DOWNLOADS]: The skill facilitates downloading software components from well-known service providers. Evidence: Fetches Elasticsearch from artifacts.elastic.co, MinIO from dl.min.io, and Node.js distributions from nodejs.org or NodeSource (reference/bundling-recipes.md, templates/dockerfile-sandbox.md).
- [COMMAND_EXECUTION]: The skill facilitates the installation and execution of the platform's command-line interface. Evidence: Provides instructions for the agent to install the veris-cli using uv or pip and execute lifecycle commands such as veris env push and veris login (SKILL.md Phase 0, 6).
Audit Metadata