secure-code-review
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: Analysis of the skill instructions and supplementary files reveals no malicious intent. The skill is focused on application security verification and provides clear remediation guidance for common vulnerabilities.
- [PROMPT_INJECTION]: The skill processes untrusted code, creating an indirect prompt injection surface. 1. Ingestion points: Target files or directories provided via $ARGUMENTS and read using Read, Grep, and Glob tools in SKILL.md. 2. Boundary markers: The skill includes a dedicated 'Prompt Injection Safety Notice' instructing the agent to treat reviewed content as inert text and ignore any instructions within it. 3. Capability inventory: The skill is limited to read-only operations (Read, Grep, Glob) according to the allowed-tools frontmatter. It has no tools for file modification, network access, or command execution. 4. Sanitization: The skill relies on explicit behavioral instructions to prevent the agent from obeying instructions embedded in the untrusted source code.
Audit Metadata