codebase-onboarding
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from an external, potentially untrusted codebase, which creates a surface for indirect prompt injection.
- Ingestion points: The agent reads project manifest files (e.g., package.json, pyproject.toml), framework configurations, entry point files, and directory structures across the entire repository (SKILL.md, Phases 1-3).
- Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" warnings to help the agent distinguish between the code it is analyzing and potential instructions hidden within that code (e.g., in comments or READMEs).
- Capability inventory: The skill possesses extensive file-reading capabilities and the ability to write or modify project files (specifically AGENTS.md), creating a path for malicious instructions in the codebase to influence future agent interactions with the repo.
- Sanitization: There is no requirement for the agent to sanitize or validate the content extracted from the codebase before interpolating it into the generated onboarding guide or AGENTS.md file.
Audit Metadata