auditing-config-and-build-hygiene
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill is composed entirely of Markdown instructions, reference heuristics, and JSON evaluation data. It does not include any executable scripts (Python, Node.js, or Shell).
- [PROMPT_INJECTION]: The skill is designed to audit untrusted repository content, including CI workflows, Dockerfiles, and configuration files, which presents a surface for indirect prompt injection.
- Ingestion points: The agent is instructed to read various files from the repository being audited, including
.github/workflows/*.yml,Dockerfile, and application settings. - Boundary markers: The skill does not provide specific instructions to the agent to use delimiters or ignore embedded instructions within the audited data.
- Capability inventory: The skill's primary capabilities are reading files and providing diagnostic reports; it does not request network access or administrative permissions.
- Sanitization: There are no instructions for sanitizing or escaping content from the audited files before processing.
- [SAFE]: The skill mentions and recommends the use of well-known and trusted security tools such as Gitleaks, TruffleHog, and Hadolint for automated auditing. All references to external scripts and commands (e.g., curl-pipe-bash patterns) are provided as negative examples for the auditor to detect and flag, rather than instructions to execute.
Audit Metadata