build-agent-embedded
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes instructions for running
cppcheckto perform static analysis and MISRA-C:2012 compliance checks. This is a standard and expected development tool for embedded systems and does not represent a security risk. - [DYNAMIC_EXECUTION]: The skill provides a
CMakeLists.txttemplate and mentions GNU Make for firmware build orchestration. These are standard build system configurations for C/C++ projects. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process requirement specifications (e.g.,
REQ-XXXX). While this represents a data ingestion surface, the skill includes robust mitigations such as mandatory traceability headers, build manifest logging, and explicit instructions to implement CWE prevention measures (like bounds checking and safe string copying). - Ingestion points: Requirement identifiers and descriptions processed via the
build-agentinherited loop. - Boundary markers: Uses structured
Build Manifestdocumentation and per-file traceability headers (e.g.,/* Parent: REQ-0001 */). - Capability inventory: Code synthesis, static analysis invocation (
cppcheck), and build system generation (CMake). - Sanitization: Explicitly defines patterns for buffer overflow prevention (CWE-119/120), MISRA compliance, and redundant sensor validation (ASIL-D).
Audit Metadata