security-threat-model
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary purpose is defensive security analysis (threat modeling). It provides structured templates for analyzing repo security without introducing malicious logic.
- [PROMPT_INJECTION]: No evidence of prompt injection or instructions to bypass safety guidelines was found. The skill includes instructions to maintain security hygiene, specifically redacting secrets (redaction rule in
references/prompt-template.md). - [EXTERNAL_DOWNLOADS]: The skill does not perform any external network requests or downloads. It operates on the local repository context provided by the user.
- [REMOTE_CODE_EXECUTION]: No remote code execution patterns or dynamic code execution (eval/exec) were found in the skill's instructions or templates.
- [DATA_EXFILTRATION]: There are no commands or instructions to exfiltrate data. The output is a Markdown report generated for the user within the agent's environment.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials or instructions to expose secrets were detected. The skill specifically warns the agent: 'Never output secrets. If you encounter tokens/keys/passwords, redact them'.
Audit Metadata