scan-reward-hacking
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a static analysis utility for TypeScript projects. It identifies specific code patterns using allowed tools like Grep and Glob to improve type safety. No malicious behavior, such as data exfiltration or unauthorized system access, was detected.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by reading project source files for pattern matching. The risk is assessed as safe because the content is used for identification of regex-based patterns rather than being interpreted as instructions for the agent's execution logic.
- Ingestion points: Accesses files within src/, apps/, packages/, and lib/ directories or user-specified paths.
- Boundary markers: None explicitly defined, but operations are restricted to searching for hardcoded strings.
- Capability inventory: Utilizes Bash, Read, Grep, and Glob for file discovery and content inspection.
- Sanitization: None, as the content is not executed or evaluated as code.
Audit Metadata