knowledge-portal
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/launch.cjsusesexecSyncandspawnto manage local services. It executesnpm run devornpm run buildand launches a background bridge server (node bridge.cjs) in thetools/chronos-mirrordirectory. - [EXTERNAL_DOWNLOADS]: The skill triggers
npm installwithin a local tool directory ifnode_modulesare not detected, resulting in the download of external packages from the NPM registry. - [PROMPT_INJECTION]: The skill displays an indirect prompt injection surface by ingesting and rendering data from external sources such as
PERFORMANCE_DASHBOARD.mdand ACE Engine decision logs. - Ingestion points:
PERFORMANCE_DASHBOARD.mdand ACE Engine decision logs as described in the skill capabilities. - Boundary markers: No explicit boundary markers or directives to ignore embedded instructions were found in the provided files.
- Capability inventory: The skill can execute shell commands (
execSync) and spawn background processes (spawn) via thelaunch.cjsscript. - Sanitization: No sanitization or validation logic is present for the data ingested from the dashboard or logs before visualization.
Audit Metadata