audit
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill contains defensive instructions to mitigate prompt injection. Hard Rule 6 in SKILL.md explicitly commands the agent to treat all repository content as data and ignore any embedded instructions (e.g., 'ignore previous instructions'), reporting them as security findings instead.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: Hard Rule 4 prevents sensitive data leakage by prohibiting the reproduction of credentials, tokens, or .env contents in output. The skill only allows referencing the location and type of secrets for rotation recommendations.\n- [COMMAND_EXECUTION]: The skill utilizes read-only analysis tools (git, npm audit, tsc, lint). For code modification, it dispatches subagents to isolated git worktrees, ensuring the user's primary environment is not mutated without oversight. It also uses the GitHub CLI (gh) with a mandatory privacy check for public repositories.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted codebases as a core function. It manages this attack surface through the following evidence chain:\n
- Ingestion points: Audited repository files (source code, READMEs, configs).\n
- Boundary markers: Hard Rule 6 and explicit subagent prompt instructions define content as data-only.\n
- Capability inventory: Shell command execution (git, gh, audit tools) and subagent spawning.\n
- Sanitization: Strict instructions to report embedded commands as findings rather than executing them.
Audit Metadata