skills/asiaostrich/code-buddy/derive/Gen Agent Trust Hub

derive

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No security issues were detected. The skill uses standard file system tools (Read, Write, Grep, Glob) to transform specification documents into test structures and templates.
  • [PROMPT_INJECTION]: The skill contains no instructions attempting to bypass safety filters or override agent behavior. It includes explicit 'Anti-Hallucination Rules' and 'Core Principles' that enforce strict 1:1 mapping between specifications and generated content, which acts as a functional safeguard.
  • [DATA_EXFILTRATION]: No network access or data exfiltration patterns were identified. The skill does not use network tools like curl or wget, and it targets standard documentation and test file paths without accessing sensitive configuration directories.
  • [COMMAND_EXECUTION]: No arbitrary command execution patterns were found. The skill instructions focus on content transformation and template generation.
  • [EXTERNAL_DOWNLOADS]: The skill references documentation and standards from the author's public GitHub repository (AsiaOstrich/universal-dev-standards). These are informational links and do not involve executing remote code or scripts.
  • [DATA_INGESTION]: While the skill processes untrusted specification files (representing an Indirect Prompt Injection surface), it implements traceability requirements and 'Source' tagging for all outputs. This allows for clear human verification of the origin of all generated content, mitigating risks associated with processing external data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 03:37 AM
Security Audit — agent-trust-hub — derive