living-surface

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands using the lp (LivePowers) CLI tool. These include lp surface validate, lp surface record, lp surface promote, and lp surface deploy. These operations are central to the skill's primary purpose of managing business application surfaces.
  • [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data from user intents and external JSON templates to generate database queries and UI components.
  • Ingestion points: Processes user intents and data from templates/surface.json to define analytics surfaces.
  • Boundary markers: While no specific text delimiters are mentioned, the skill mandates a separate validation process using lp surface validate before any display occurs.
  • Capability inventory: Involves shell command execution (lp), database access (--db flags), and metadata logging to the file system.
  • Sanitization: Explicitly requires validation to ensure "no executable code," "only read-only queries," and "ontology adherence."
  • [DYNAMIC_EXECUTION]: The skill facilitates the generation and application of DDL (SQL) scripts for database schema evolution. This behavior is mitigated by a multi-step "growth" pipeline that includes twin-environment testing, automated reconciliation, and human acceptance gates.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 01:34 AM