clay-incident-runbook
Warn
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
kubectlcommands inreferences/implementation-guide.mdto modify production cluster resources, including updating deployment environment variables (kubectl set env) and triggering rolling restarts (kubectl rollout restart). It also executes a local script./scripts/clay-debug-bundle.shfor evidence collection.\n- [CREDENTIALS_UNSAFE]: The implementation guide provides a command to extract, decode, and display sensitive API keys from Kubernetes secrets (kubectl get secret clay-secrets -o jsonpath='{.data.api-key}' | base64 -d), exposing them to the agent's environment.\n- [PROMPT_INJECTION]: The skill ingests untrusted input from application logs and external status endpoints, creating a potential surface for indirect prompt injection.\n - Ingestion points: Log data is retrieved using
kubectl logsinreferences/implementation-guide.md.\n - Boundary markers: No delimiters or warnings are used to distinguish untrusted log content from instructions.\n
- Capability inventory: The skill has significant capabilities to modify the cluster environment via
kubectlas documented inreferences/implementation-guide.md.\n - Sanitization: There is no evidence of filtering or validation for the data ingested from logs or metrics.
Audit Metadata