besser-user
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official BESSER library and repository. Users are instructed to install the platform via 'pip install besser' or by cloning from the 'BESSER-PEARL' GitHub organization, which are trusted vendor sources for this skill.
- [DYNAMIC_EXECUTION]: The documentation identifies support for arbitrary Python code execution within B-UML models via 'CustomCodeAction' and 'Condition' elements. This is a core architectural feature of the BESSER platform for defining model behavior and is presented neutrally as developer reference material.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined model requirements to generate Python code. While the utility script 'scripts/scaffold_model.py' lacks robust sanitization for class and attribute names, which could lead to code injection if malicious inputs are used, this represents a standard functional surface for a developer-oriented code generation tool rather than a malicious pattern.
- Ingestion points: User-provided class and attribute names in the 'scaffold_model.py' script and general design requirements.
- Boundary markers: None explicitly defined in the provided instructions or script logic.
- Capability inventory: Writing Python source files (.py) and Markdown documentation with embedded code blocks.
- Sanitization: The 'scaffold_model.py' script performs simple case conversion but does not escape characters that could break out of string literals or variable assignments.
Audit Metadata