repos-code-search
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Azure Repos, creating a surface for indirect prompt injection.
- Ingestion points: The skill fetches source code, directory structures, and commit messages from external repositories in SKILL.md under '搜尋程式碼' (Rule 1), '讀取檔案' (Rule 2), and '查詢 commit 歷史' (Rule 4).
- Boundary markers: The instructions do not specify the use of clear delimiters or instructions for the agent to ignore potentially malicious prompts embedded within the retrieved code or commit comments.
- Capability inventory: The skill utilizes curl to read file contents, list directories, and query repository metadata.
- Sanitization: While URL encoding is applied to API parameters, there is no evidence of sanitization or filtering for the actual content retrieved from the files or commit logs.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch data from well-known services. It connects to dev.azure.com and almsearch.dev.azure.com, which are official Azure DevOps domains required for its stated functionality.
Audit Metadata