blast-radius
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructions direct the agent to 'Write a script or test that runs the real code, run it, and paste what happened' (source: SKILL.md, Step 5). This facilitates the runtime generation and execution of scripts based on user-provided or external code.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as code diffs, library source code, and API JSON payloads (source: SKILL.md, Steps 1 and 3). Since the agent generates test code based on its interpretation of these sources without explicit boundary markers or sanitization rules, it is vulnerable to malicious patterns in the analyzed code influencing the resulting execution logic.
Audit Metadata