source-code-hunting
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructs the agent to analyze and process untrusted external data from source code leaks, git history, and configuration files. This creates an attack surface for indirect prompt injection, where malicious instructions embedded in the analyzed code could attempt to override the agent's behavior.
- Ingestion points: External source code repositories, .git metadata, and configuration files like .npmrc or composer.json as referenced in SKILL.md.
- Boundary markers: The skill does not provide specific delimiters or instructions to treat findings as data rather than instructions.
- Capability inventory: The methodology involves using tools like grep, git, and Node.js to read and interpret file contents.
- Sanitization: No sanitization or validation steps are suggested for content found in external leaks before it is processed by the agent.
- [SAFE]: The skill contains no executable code, remote downloads, or hardcoded credentials. It provides legitimate security research methodologies and tool references for penetration testing and auditing.
Audit Metadata