codeguard-security-api
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill consists exclusively of Markdown-based instructions, checklists, and examples. There are no scripts (Python, JavaScript, shell) or binaries included that could execute arbitrary commands.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-provided code for security vulnerabilities. While this creates an ingestion surface for potentially malicious instructions embedded in user data, the skill includes several mitigative design features. 1. Ingestion points: Code snippets and API schemas provided by the user for review. 2. Boundary markers: The skill defines a strict 'Decision Contract' and 'Evidence Playbook' to structure the agent's reasoning. 3. Capability inventory: The skill itself performs no file-system writes or network operations. 4. Sanitization: The skill explicitly instructs the agent to avoid echoing credentials, secrets, or private data in its output.
- [SAFE]: The skill promotes defensive security practices, such as mandatory server-side validation of tenant and user identifiers and the use of anti-replay mechanisms for public APIs.
Audit Metadata