portal-external-app

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to assist developers in executing management commands such as bun run register-app and Docker Compose workflows. These commands are necessary for service registration and local orchestration within the platform's ecosystem.
  • [EXTERNAL_DOWNLOADS]: The documentation references downloading Docker images from private registries and fetching health status from service endpoints. These operations are standard components of the deployment and verification process described in the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow for reviewing external manifest files and contract documentation.
  • Ingestion points: Processes external app.manifest.json files and service contract documentation provided by third-party teams as described in SKILL.md and references/contract-doc-template.md.
  • Boundary markers: The instructions include a comprehensive "Delivery Review Checklist" to guide the agent and developer in verifying content manually.
  • Capability inventory: The skill utilizes bun run register-app to update platform databases/configurations and fetch (in scripts/verify-health.ts) to probe network endpoints.
  • Sanitization: The platform performs strict schema validation on incoming manifests (evidenced by VALIDATION_FAILED references in references/registration-and-onebox.md) and enforces namespace-based scope restrictions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 04:21 AM
Security Audit — agent-trust-hub — portal-external-app