axiom-scan-security-privacy
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed as a local security auditor. It uses grep and glob patterns to scan source code and configuration files for common security anti-patterns and privacy manifest requirements.
- [DATA_EXPOSURE]: The skill requests access to project files including Swift source code, Info.plist, and entitlements files. This access is necessary for its stated purpose of security auditing. There are no network-capable tools or exfiltration patterns detected.
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to use built-in tools like Glob and Grep. It does not attempt to execute arbitrary shell commands or bypass permission models.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (source code) which could potentially contain malicious instructions. However, the risk is mitigated by the structured auditing workflow and the use of the 'disable-model-invocation: true' flag, which limits the agent to tool-based analysis rather than open-ended reasoning on untrusted input.
Audit Metadata