threat-modeling-expert
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill consists entirely of markdown instructions and metadata. It does not contain any Python scripts, Node.js code, shell commands, or other executable artifacts.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze system architecture details and data flow diagrams provided by users. This creates a potential surface for indirect prompt injection if the processed data contains malicious instructions, although the skill lacks any active capabilities that could be exploited.
- Ingestion points: System documentation and data flow diagrams provided during the threat modeling process described in SKILL.md.
- Boundary markers: None specified in the instructions.
- Capability inventory: None (this is a reasoning-only instructional skill).
- Sanitization: None specified.
- [SAFE]: The instructions follow standard security practices for threat modeling (e.g., STRIDE, PASTA) and do not include any patterns associated with prompt injection, data exfiltration, or persistence.
Audit Metadata