se-dev-torch
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the uv package manager installer from the official astral.sh website.- [EXTERNAL_DOWNLOADS]: Downloads the BusyBox executable for Windows from frippery.org.- [EXTERNAL_DOWNLOADS]: Clones the Torch framework source code from its official GitHub repository.- [REMOTE_CODE_EXECUTION]: Executes the uv installer script via piping to a shell environment during the preparation phase.- [COMMAND_EXECUTION]: Runs UNIX-style commands using BusyBox on Windows systems to provide a consistent environment.- [INDIRECT_PROMPT_INJECTION]: The skill processes external C# source code from the indexed Torch repository.
- Ingestion points: index_torch.py reads C# files from the Torch repository; search_torch.py reads the resulting CSV index files.
- Boundary markers: The skill does not explicitly use boundary markers to separate code content from instructions in its output to the agent.
- Capability inventory: The skill allows execution of shell commands and Python scripts.
- Sanitization: Code is parsed structurally using tree-sitter, providing some level of abstraction, but the search tool returns raw code snippets.
Audit Metadata