github-repo-launch-page
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to analyze content from external repositories (READMEs, configuration files, and metadata). This introduces a surface for indirect prompt injection, as malicious instructions placed in those files could attempt to influence the agent's output during the audit process. However, the skill lacks dangerous capabilities that would allow such an injection to perform sensitive actions.
- [SAFE]: The instructions include checks for sensitive files such as
.sshkeys and.envfiles specifically to advise the user to avoid leaking them in public repositories. This is a standard security best practice and does not involve exfiltration. - [SAFE]: All suggested commands (e.g.,
npm install,pip install) are provided as examples for inclusion in user documentation and are not executed by the skill itself.
Audit Metadata