programming-tutor

Pass

Audited by Gen Agent Trust Hub on Jul 1, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/run_tests.py utility uses subprocess.run to invoke local testing frameworks such as pytest, unittest, and jest. The implementation constructs commands as lists of arguments and does not use shell=True, adhering to security best practices for executing local processes.
  • [DATA_EXFILTRATION]: No network operations or unauthorized data transmission patterns were identified. The skill interacts only with local files for code analysis and maintaining the user learning log at references/user-progress/learning_log.md, which is a documented feature.
  • [PROMPT_INJECTION]: The skill instructions define pedagogical boundaries that reinforce safety. It explicitly mandates the use of the Socratic method for debugging and forbids providing direct answers, effectively serving as a behavioral constraint to ensure interactive learning.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 1, 2026, 12:27 PM
Security Audit — agent-trust-hub — programming-tutor