security-engineer
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill functions as a security guidance system, using Thai language contexts and standard security benchmarks like OWASP to help developers secure their applications.
- [DYNAMIC_EXECUTION]: Deterministic detectors flagged the use of 'exec(user_input)' in 'templates/prompt-main.md'. This is a false positive; the pattern is used in a checklist to instruct the agent to identify and flag insecure command execution in the target code being audited.
- [INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface (user code provided for audit). Evidence chain: 1) Ingestion point: Code/endpoints provided via skill invocation (SKILL.md). 2) Boundary markers: Absent. 3) Capability inventory: Analysis-only (no automated file-write or network operations) as defined in SKILL.md and templates/prompt-main.md. 4) Sanitization: The skill includes specific checks for prompt injection vulnerabilities in the target software. The risk is considered low given the intended use case.
Audit Metadata