nimble-agents

Pass

Audited by Gen Agent Trust Hub on Feb 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill generates and executes local Python and Node.js scripts to automate data scraping and perform agent validation. It utilizes the Bash tool to run these scripts via uv run and npx, relying on predefined templates provided in the skill's reference documentation.
  • [PROMPT_INJECTION]: The skill processes content from external websites to discover page structures and refine extraction logic, which introduces a surface for indirect prompt injection.
  • Ingestion points: Data enters the context via nimble_web_search and interactive agent results during the discovery and validation phases.
  • Boundary markers: The instructions do not define specific delimiters or isolation protocols to distinguish ingested web content from agent instructions.
  • Capability inventory: The skill possesses capabilities for command execution, file system access (writing to /tmp), and network operations through the generated scripts.
  • Sanitization: External web data is processed directly to inform the generation of schemas and scripts without explicit sanitization or filtering logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 25, 2026, 12:46 PM