a1-yandex-kit-orders
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted store data such as delivery notes and order comments. It includes a dedicated security boundary in SKILL.md instructing the agent to ignore any embedded commands and maintain the authorized workflow. Evidence: 1) Ingestion points: store data fields (delivery notes, comments). 2) Boundary markers: 'Untrusted store text' instructions. 3) Capability inventory: order management tools and API access. 4) Sanitization: instructions to use minimum excerpts.
- [COMMAND_EXECUTION]: Local Node.js scripts are used for documentation search, with execution restricted via the allowed-tools configuration to specific scripts (search_docs.mjs, validate.mjs), preventing arbitrary command injection.
- [EXTERNAL_DOWNLOADS]: Documentation states that bundled scripts are self-contained and analysis of search_docs.mjs confirms no external package requirements or network activity during document searches.
Audit Metadata