decompiler
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes SQL queries to interact with an underlying binary analysis tool (IDA Pro). This includes
SELECTqueries to read data andUPDATEqueries to modify function names, local variable types, and decompiler comments. - [INDIRECT_PROMPT_INJECTION]: The skill processes data extracted from binary files (pseudocode, strings, variable names). This creates an attack surface for indirect prompt injection if the binary being analyzed contains adversarial content. (1) Ingestion points:
decompile(),ctree,ctree_lvars,ctree_call_args, andpseudocodetables (SKILL.md). (2) Boundary markers: Not explicitly defined in the instructions. (3) Capability inventory: The skill can write back to the analysis database usingUPDATEstatements on multiple tables and persist changes viasave_database()(SKILL.md, references/decompiler-workflows.md). (4) Sanitization: No explicit sanitization or escaping of binary-derived content is mentioned. - [DYNAMIC_EXECUTION]: The skill utilizes the
parse_decls()SQL function to dynamically parse and apply C-style type declarations at runtime, which is a standard feature for improving decompiler output quality (references/decompiler-workflows.md).
Audit Metadata