security-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze potentially untrusted source code, which inherently presents an indirect prompt injection surface.
- Ingestion points: The agent is instructed to inspect the current project repository and analyze all identified languages and frameworks (SKILL.md, Workflow section).
- Boundary markers: The skill defines specific trigger conditions for security reviews and provides a structured decision tree for loading relevant guidance from the
references/directory. - Capability inventory: The agent has the capability to generate detailed vulnerability reports in markdown format and propose code modifications to fix security issues.
- Sanitization: The skill relies on the provided normative security specifications to guide the agent in identifying and mitigating risks within the ingested data.
- [SAFE]: The skill consists entirely of markdown instructions and security specifications. It does not contain any executable code, does not perform network operations, and does not request or store sensitive credentials. All guidance provided aligns with industry standard security best practices (OWASP, framework-specific documentation).
Audit Metadata