source-code-hunting
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze external source code, git histories, and JavaScript bundles for security vulnerabilities. This exposes the agent to malicious instructions that could be embedded in the code under review.
- Ingestion points: External source code repositories, .git logs, and JavaScript bundles provided for analysis (SKILL.md).
- Boundary markers: The instructions do not define boundary markers to separate code-under-analysis from the agent's logic (SKILL.md).
- Capability inventory: The methodology suggests using file system search tools (grep), secret scanners (trufflehog), and static analysis tools (semgrep, CodeQL) to process external data (SKILL.md).
- Sanitization: No sanitization or escaping mechanisms are described for the content being analyzed.
Audit Metadata