security-threat-model
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the ripgrep utility to explore and search the target repository for security-relevant patterns and entry points.
- [PROMPT_INJECTION]: The skill processes untrusted repository content, which creates a surface for indirect prompt injection. Malicious instructions within the analyzed codebase could attempt to manipulate the generated threat model. * Ingestion points: File reading and directory analysis of the target repository. * Boundary markers: Explicit instructions to use evidence anchors and follow a structured prompt template. * Capability inventory: File system access, shell command execution via ripgrep, and file creation for the final report. * Sanitization: Built-in requirements to redact credentials and verify claims against repository evidence.
- [SAFE]: The skill implements security-conscious behaviors, including the mandatory redaction of secrets and the validation of assumptions with the user before finalizing reports.
Audit Metadata