jev-act
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing external, potentially untrusted data such as browser snapshots or simulation states to select next actions. This creates a surface for indirect prompt injection attacks where malicious instructions could be embedded in the observed state.
- Ingestion points: Data is ingested via the 'state' and 'elements' fields in JSON files such as 'assets/example.json' and 'assets/world.json'.
- Boundary markers: The skill uses structured JSON to separate data from instructions and advises batching independent checks to prevent cross-question interference.
- Capability inventory: Ingested data influences action selection, which the host agent then executes in the browser or simulator.
- Sanitization: The instructions suggest removing secrets from context, but the skill lacks automated sanitization or strict schema validation.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the 'jev-decide' CLI tool.
- Evidence: SKILL.md contains command examples like 'jev-decide decide /assets/example.json --dry-run'.
- [EXTERNAL_DOWNLOADS]: The skill relies on the external 'jev-decide' CLI tool and external API services (OpenRouter, TypeSafe).
- Evidence: SKILL.md identifies these as dependencies and requires API keys, although it explicitly forbids the agent from silently installing the CLI tool.
Audit Metadata