find-bugs
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides a legitimate framework for code security auditing using read-only Git operations. No evidence of credential theft, remote code execution, or data exfiltration was detected.
- [PROMPT_INJECTION]: The skill processes untrusted source code from local branches, creating an indirect prompt injection surface. Because the skill's capabilities are restricted to reading and reporting, this risk is assessed as safe.
- Ingestion points: Reads code changes via
git diff master...HEADand individual file reads as described in Phase 1 ofSKILL.md. - Boundary markers: None; the skill does not specify delimiters to separate code from instructions.
- Capability inventory: Limited to read-only file access and standard Git commands; no network or file-write capabilities are requested in the skill context.
- Sanitization: Not present, as the tool is intended to analyze raw code content.
Audit Metadata