fix
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it ingests untrusted data from the codebase and finding records to perform automated file edits.
- Ingestion points: The skill reads vulnerability metadata from
.appsec/findings.jsonand source code snippets from the project directory (SKILL.md, Step 1 and Step 2). - Boundary markers: The instructions do not mandate the use of boundary markers or specific "ignore" instructions when interpolating external content (findings or code) into the agent's context.
- Capability inventory: The skill uses the
Readtool for file access and theEdittool to modify the filesystem (SKILL.md, Step 6). - Sanitization: There is no explicit sanitization or filtering mentioned to prevent instructions embedded within the analyzed code or finding descriptions from influencing the agent's behavior during fix generation.
Audit Metadata