forge-security-review
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the Forge Static Review Tool (FSRT) binary from the official
atlassian-labsGitHub repository. This behavior is a core part of the skill's functionality to perform automated security scans on Forge projects. - [COMMAND_EXECUTION]: The skill executes local orchestration scripts (
run_static_analysis.shandrun_static_analysis.ps1) to download the scanner binary and initiate code analysis on the target project directory. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted third-party source code and configuration files, such as
manifest.ymland resolver handlers. - Ingestion points: Reads the entire Forge project directory provided by the user.
- Boundary markers: None explicitly defined in the skill instructions; the agent relies on its internal logic to treat the code as data for analysis.
- Capability inventory: The skill can execute shell scripts and binaries, read from the file system, and generate security reports.
- Sanitization: No specific sanitization or escaping of the analyzed source code is performed prior to the review process.
Audit Metadata