codebase-onboarding
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection.\n
- Ingestion points: The skill reads codebase files, including manifests and source code, during Phase 1, 2, and 3 to identify architecture and conventions.\n
- Boundary markers: Absent. The instructions do not define delimiters or instruct the agent to ignore natural language instructions encountered within the codebase files.\n
- Capability inventory: The skill has the capability to write a CLAUDE.md file, which contains persistent instructions that the agent will follow in subsequent interactions with the repository.\n
- Sanitization: Absent. Content extracted from the analyzed repository is incorporated directly into the onboarding guide and CLAUDE.md without explicit sanitization or filtering.
Audit Metadata