portal-external-app
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to assist developers in executing management commands such as
bun run register-appand Docker Compose workflows. These commands are necessary for service registration and local orchestration within the platform's ecosystem. - [EXTERNAL_DOWNLOADS]: The documentation references downloading Docker images from private registries and fetching health status from service endpoints. These operations are standard components of the deployment and verification process described in the skill.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow for reviewing external manifest files and contract documentation.
- Ingestion points: Processes external
app.manifest.jsonfiles and service contract documentation provided by third-party teams as described inSKILL.mdandreferences/contract-doc-template.md. - Boundary markers: The instructions include a comprehensive "Delivery Review Checklist" to guide the agent and developer in verifying content manually.
- Capability inventory: The skill utilizes
bun run register-appto update platform databases/configurations andfetch(inscripts/verify-health.ts) to probe network endpoints. - Sanitization: The platform performs strict schema validation on incoming manifests (evidenced by
VALIDATION_FAILEDreferences inreferences/registration-and-onebox.md) and enforces namespace-based scope restrictions.
Audit Metadata