using-backstage-catalog
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents methods to ingest entity data from the Backstage catalog. Since catalog data is often populated from external sources such as YAML files in Git repositories, it provides a potential vector for indirect prompt injection where adversarial instructions could be embedded in metadata.
- Ingestion points: The pattern files 'references/fetch-by-ref.md' and 'references/query-entities.md' describe using methods like
getEntityByRefandgetEntitiesto pull external data into the agent's context. - Boundary markers: The provided code examples do not demonstrate the use of delimiters or explicit 'ignore' instructions when processing fetched entity metadata to prevent the model from following instructions found in the data.
- Capability inventory: The skill includes patterns for reading catalog data and performing writes such as registering new locations via
addLocation. - Sanitization: The snippets show direct access to metadata and specification fields (e.g.,
entity.metadata.name,entity.metadata.title) without validation or sanitization of the content before it is used.
Audit Metadata