coral-create-source-spec
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external provider API documentation and local datasets to generate Coral source specifications. This data is then processed by CLI tools like
coral source addandcoral sql.\n - Ingestion points: API documentation and local datasets are read from the environment as described in SKILL.md.\n
- Boundary markers: No specific delimiters or instructions are provided to the agent to isolate untrusted data from its core instructions.\n
- Capability inventory: The skill utilizes
coral source lint,coral source add, andcoral sqlto perform system operations.\n - Sanitization: The skill employs
coral source lintto validate the generated YAML schema before it is used.\n- [DYNAMIC_EXECUTION]: The skill's primary workflow involves generating configuration files (Coral source specs) and subsequently invoking them through thecoralCLI. This pattern of generating and then executing structured content represents a dynamic execution risk.
Audit Metadata