dagu-rest-api
Pass
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: SAFE
Full Analysis
- [Prompt Injection] (SAFE): No instructions attempting to bypass safety filters or override agent constraints were found.
- [Data Exposure & Exfiltration] (SAFE): The skill interacts with local or internal server addresses (localhost:8080). No evidence of credential exposure or unauthorized data transmission to external domains was identified.
- [Unverifiable Dependencies & Remote Code Execution] (SAFE): The skill utilizes standard tools such as the curl utility and the Python requests library. No remote script execution or installation of suspicious packages was observed.
- [Command Execution] (SAFE): API operations to trigger or modify workflows are part of the intended Dagu functionality and do not represent unauthorized local command execution on the host system.
- [Indirect Prompt Injection] (SAFE): While the skill involves reading workflow logs and statuses which are external data sources, no malicious instructions targeting the agent were found in the documentation.
Audit Metadata