gitignore-respecting-search
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The Python implementation
search_repo_ripgrepinSKILL.mdutilizessubprocess.runto execute the externalrg(ripgrep) binary. This is a legitimate functional requirement for the skill's purpose but involves spawning external processes with arguments. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of repository file contents which are untrusted data. If the search results contain malicious instructions hidden in code comments or documentation, the agent might attempt to follow them.
- Ingestion points: File contents retrieved from the local repository via the
ripgrepsearch wrapper inSKILL.md. - Boundary markers: The provided implementation lacks explicit delimiters or instructions to the agent to treat search output as untrusted data.
- Capability inventory: Subprocess execution of
ripgrepfor file system access (read-only search). - Sanitization: No escaping, filtering, or validation is performed on the file content before it is passed to the agent context.
Audit Metadata