audit
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code and metadata as its primary input. While it contains explicit instructions (the 'Untrusted-content envelope') to ignore embedded instructions and treat the content as data, this ingestion point presents a surface for indirect prompt injection attacks.
- Ingestion points: SKILL.md defines target source, context slices, and checklist metadata as analysis targets.
- Boundary markers: Present. The skill defines an 'Untrusted-content envelope' and instructs the agent to ignore instruction-shaped text within it.
- Capability inventory: The skill executes subprocesses (raptor-audit, raptor-smt-check-overflow, raptor-run-sandboxed gcc) and writes to the local file system (findings.json, review-journal.jsonl).
- Sanitization: The instructions require the agent to flag suspicious instruction-shaped text to the operator.
- [DYNAMIC_EXECUTION]: The workflow includes the generation and execution of mechanical tests at runtime, including structural rules (Semgrep, Coccinelle) and sandboxed compilation and execution of C code via gcc in review.md.
- [COMMAND_EXECUTION]: The skill uses a variety of command-line tools located in the libexec/ directory for orchestration and validation (e.g., raptor-audit, raptor-run-lifecycle).
Audit Metadata