codeguard-scala
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
scalafmtCLI tool for project auditing and formatting. This is the intended primary functionality. The skill provides safety-oriented instructions to probe the environment (scalafmt --version) and perform read-only checks (--check .) before executing any modifications. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process Scala source files (
.scala,.sc), which creates a standard attack surface for indirect prompt injection common to developer tooling. - Ingestion points: Local project files including
.scala,.sc, andbuild.sbt(SKILL.md, references/tooling/toolchain.md). - Boundary markers: While explicit markdown delimiters for file content are not specified, the skill mandates a strict output template to maintain context separation.
- Capability inventory: The skill's actions are restricted to local file reading, formatting via
scalafmt, and running existing project build/test commands. - Sanitization: No internal sanitization is performed on file contents, but the skill includes explicit rules against silent modifications and manual override of safety violations.
Audit Metadata