external-gitcode-ascend-megatron-change-analyzer

Pass

Audited by Gen Agent Trust Hub on Apr 18, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [SAFE]: No security issues detected. The skill implements repository change analysis through local scripts and markdown documentation. It does not perform network requests, access sensitive system files, or execute remote code. A hardcoded reference to a local path was identified in the documentation but does not pose a security risk to the end user.- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes external commit and PR data from the Megatron-LM repository. This is an inherent part of its analytical function and is mitigated by the fact that the data is used for classification rather than execution.\n- Ingestion points: The script scripts/build_feature_events.py processes JSON change-sets provided as input.\n- Boundary markers: None identified in the script or instructions.\n- Capability inventory: The skill can read input files and write output reports to the local file system via the provided script.\n- Sanitization: Title cleaning is performed via regular expressions, though it is not specifically designed for injection mitigation.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 18, 2026, 03:04 AM
Security Audit — agent-trust-hub — external-gitcode-ascend-megatron-change-analyzer