secure-code-guardian
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The author identified in the skill's YAML frontmatter (https://github.com/Jeffallan) does not match the expected author context (alismx). This is a metadata inconsistency that could be misleading.
- [INDIRECT_PROMPT_INJECTION]: The skill functions as a secure code generator based on user requirements, which creates a potential surface for indirect prompt injection if the inputs contain malicious instructions.
- Ingestion points: User instructions and requirements for security-sensitive implementations (SKILL.md).
- Boundary markers: No explicit delimiters or warnings are defined to distinguish user input from the skill's core instructions.
- Capability inventory: The skill provides templates for generating authentication logic, database queries, and system configuration (SKILL.md, references/*.md).
- Sanitization: The skill does not implement specific sanitization or validation of user requirements before processing them for code generation.
Audit Metadata