race-conditions
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes established security scanners via the command line to perform static analysis on project source code.\n
- Evidence:
semgrep scan --config auto --json --quiet <target>\n - Evidence:
go vet -race ./...\n - Evidence:
bandit -r <target> -f json -q\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it is designed to ingest and analyze untrusted source code provided by users.\n - Ingestion points: User-provided source code files identified within the project scope (e.g.,
**/services/**,**/payments/**,**/workers/**).\n - Boundary markers: The skill does not explicitly define boundary markers or "ignore instructions" warnings for the processed code content.\n
- Capability inventory: The skill has the ability to execute shell commands for static analysis tools and generate detailed security reports based on code content.\n
- Sanitization: No explicit sanitization or filtering of the source code content is mentioned before analysis.
Audit Metadata