nuke-recon
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill builds a structural map by distilling content from untrusted repository files, including manifests and instruction files like CLAUDE.md or .cursorrules. This ingestion process creates a vulnerability to indirect prompt injection, as malicious instructions embedded in these files could influence the agent's logic during the mapping phase or affect downstream agents consuming the map.
- Ingestion points: The skill reads repository manifest files (e.g., package.json, Cargo.toml), project instruction files (CLAUDE.md, AGENTS.md, .cursorrules, copilot-instructions), and CI workflow configurations.
- Boundary markers: No explicit boundary markers or instructions to ignore embedded commands within ingested content are specified in the protocol.
- Capability inventory: The skill has read access to the repository and write access to the
.nuke/repo-map.mdcache file. - Sanitization: There is no documented logic for sanitizing or filtering the content ingested from these external files before processing.
- [COMMAND_EXECUTION]: The skill resolves and records build, test, and lint commands directly from manifest scripts and CI workflows. While nuke-recon itself is intended to be read-only, it serves as the data provider for subsequent execution skills. Malicious commands identified during this recon phase will be propagated into the shared repository map for future execution.
Audit Metadata