living-surface
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands using the
lp(LivePowers) CLI tool. These includelp surface validate,lp surface record,lp surface promote, andlp surface deploy. These operations are central to the skill's primary purpose of managing business application surfaces. - [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data from user intents and external JSON templates to generate database queries and UI components.
- Ingestion points: Processes user intents and data from
templates/surface.jsonto define analytics surfaces. - Boundary markers: While no specific text delimiters are mentioned, the skill mandates a separate validation process using
lp surface validatebefore any display occurs. - Capability inventory: Involves shell command execution (
lp), database access (--dbflags), and metadata logging to the file system. - Sanitization: Explicitly requires validation to ensure "no executable code," "only read-only queries," and "ontology adherence."
- [DYNAMIC_EXECUTION]: The skill facilitates the generation and application of DDL (SQL) scripts for database schema evolution. This behavior is mitigated by a multi-step "growth" pipeline that includes twin-environment testing, automated reconciliation, and human acceptance gates.
Audit Metadata