full-audit
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several external security scanners and system utilities (semgrep, gitleaks, npm-audit, pip-audit, trivy, git, mkdir, ls) to assess the codebase and manage report files.
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates an attack surface for indirect prompt injection during its report assembly phase:
- Ingestion points: The report assembler subagent ingests JSON data from multiple scanner and framework subagent outputs located in the
reports/appsec/directory (SKILL.md). - Boundary markers: While a structured JSON schema is used for findings, the "notes" narrative fields are processed without explicit boundary markers or instructions to disregard potential injection attempts within the content.
- Capability inventory: The skill has the capability to read project files, execute shell commands for scanners, and write final reports to the filesystem.
- Sanitization: Narrative "notes" from subagents are included verbatim in the final Markdown report without escaping or filtering.
Audit Metadata