insecure-source-code-management
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill defines a legitimate methodology for detecting insecure source code management artifacts such as exposed
.git,.svn, and.hgdirectories, as well as backup files and environment configurations. - [EXTERNAL_DOWNLOADS]: The skill lists several open-source security tools hosted on GitHub (e.g.,
arthaud/git-dumper,internetwache/GitTools,WangYihang/GitHacker,anantshri/svn-extractor) as resources for reconstruction and recovery. These are mentioned as references and are not automatically downloaded or executed by the skill instructions. - [INDIRECT_PROMPT_INJECTION]: The skill describes processes for ingesting data from external web sources (e.g.,
/.git/config,/.env). - Ingestion points: HTTP response bodies from target web server paths defined in SKILL.md.
- Boundary markers: None explicitly defined for processing the returned content.
- Capability inventory: The skill utilizes HTTP GET/HEAD requests to retrieve data.
- Sanitization: No specific sanitization or filtering of the external content is described before the agent processes it.
Audit Metadata