ruby-cext-memory-truffle-hunt
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The static analysis tools in the references/ folder (sweep_unmarked.py, sweep_escaped_conversion.py, sweep_static_values.py) are designed to ingest and parse untrusted C/C++ source code. This represents a functional attack surface common to security auditing software. * Ingestion points: Analysis scripts read source files from user-specified directories using the pathlib module. * Boundary markers: Absent; the tools parse code directly to identify vulnerability patterns. * Capability inventory: Includes directory management via subprocess.run and low-level memory access in the Ruby harness. * Sanitization: The scripts use complex regular expressions to process source code, which is a potential target for adversarial input designed to mislead the parser.
- [COMMAND_EXECUTION]: System commands are used to support the auditing and verification processes. * sweep_unmarked.py invokes the system cp command using subprocess.run to organize test fixtures for its self-check routine. * references/repro-class-b-psych.rb executes shasum through shell backticks to confirm the integrity of loaded binary extensions. * references/harness.rb uses fork and process waiting to safely handle memory inspection in child processes. These actions are documented and integrated into the skill's primary function.
Audit Metadata