fuzz
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and analyze project source code, API handlers, and configuration files to generate tailored test cases. This behavior creates a vulnerability surface where malicious instructions hidden in the code being analyzed could influence the agent's actions.
- Ingestion points: Source code files, input handlers, and parser logic identified during analysis in Step 1 and Step 2 of the workflow.
- Boundary markers: The instructions lack specific boundary markers or requirements to treat the analyzed code as data rather than instructions, which could lead the agent to follow embedded commands.
- Capability inventory: The skill facilitates reading local project files for analysis and writing output to the
.appsec/fuzz/directory. - Sanitization: There is no requirement for the agent to sanitize, escape, or validate the content of the analyzed files before processing them.
Audit Metadata