owasp-top-10-web
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill implements defensive instructions against indirect prompt injection. It includes a dedicated 'Prompt Injection Safety Notice' that instructs the agent to treat all reviewed code as data rather than instructions and to ignore embedded directives intended to subvert the analysis.
- [DATA_EXFILTRATION]: No sensitive data access or network transmission was detected. The skill uses tools like
Read,Grep, andGlobsolely for the purpose of static code analysis within the local project context. - [COMMAND_EXECUTION]: The skill identifies command execution patterns in target codebases (e.g.,
Process.Start,exec,system) as part of its auditing function, but it does not execute arbitrary shell commands itself. - [EXTERNAL_DOWNLOADS]: The skill references several authoritative security resources (OWASP, NIST, Microsoft, MITRE). All external links point to well-known, trusted security documentation and research sites.
Audit Metadata