security-audit
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed for security auditing and includes extensive defensive instructions (e.g., Domain D10) to mitigate prompt injection and safely handle untrusted input by treating it as data rather than instructions.
- [SAFE]: Static analysis detections of obfuscation (Base64/Exec) are false positives; the identified strings in
references/security-audit-skill-vetting.md(e.g.,eval(atob(...))) are part of a checklist describing red flags for the auditor to identify, not executable code. - [SAFE]: Access to sensitive file paths such as
/etc/shadow,/etc/sudoers, and.ssh/authorized_keys(D5 checklist), along with secret scanning (D2 checklist), is consistent with the primary purpose of a system security audit and follows established best practices for compromise detection. - [SAFE]: The skill mandates the use of sandboxes and
--ignore-scriptsfor vetting operations (Domain D4), ensuring that the agent's environment remains protected when investigating potentially malicious code.
Audit Metadata