zero-script-qa
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent monitors real-time Docker log streams (
docker compose logs -f) which ingest data from various services (FastAPI, Next.js, Nginx). These logs include untrusted user data such as request parameters, paths, and error messages. - Ingestion points: Docker log stream containing application activity and user-supplied request data.
- Boundary markers: Absent. The instructions do not specify how the agent should distinguish between log structure and potential injection payloads within the log messages.
- Capability inventory: The skill is granted access to the
Bashtool and is explicitly instructed to 'Identify root cause', 'Fix code immediately', and 'Document issues' based on these logs. - Sanitization: Absent. The logging implementations provided (FastAPI middleware, Next.js logger) do not demonstrate sanitization or filtering of sensitive or potentially malicious characters in log payloads.
- [COMMAND_EXECUTION]: The skill makes extensive use of the
Bashtool to perform environment setup, log streaming, and execute E2E test scripts. While these are functional requirements, they provide a powerful execution environment that could be abused if the agent is compromised via the indirect prompt injection surface.
Audit Metadata