code-context
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides the agent with instructions to execute shell commands for managing code repositories.
- Evidence: Use of
git clone <repo-url> /tmp/<repo-name> --depth=1to fetch external code. - Evidence: Use of
rm -rf /tmp/<repo-name>for cleaning up temporary directories. - [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves ingesting and processing data from various untrusted external sources, which is a common attack vector for indirect prompt injection.
- Ingestion points: External GitHub repositories (Method 4), GitHub wikis (Method 1), library documentation repositories (Method 2), web-wide code search results (Method 3), and arbitrary web pages (Method 5).
- Boundary markers: The skill explicitly includes a 'Token Isolation' section requiring the agent to 'Never run any external lookup in the main context' and to 'Always spawn Task agents' to isolate potential malicious content.
- Capability inventory: The skill environment allows for network operations (
git clone,WebSearch,WebFetch), file system writes/cloning, and file system deletions. - Sanitization: The instructions direct the agent to 'extract architecture summary', 'return concise overview', and 'extract minimum viable API surface' rather than passing raw untrusted content directly to the user or main context.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the retrieval of content from arbitrary external URLs and repositories.
- Evidence: Downloading repository contents via
git clonefrom user-supplied or discovered URLs. - Evidence: Fetching content from high-signal web URLs discovered through
WebSearchand retrieved viaWebFetch.
Audit Metadata