ida-domain-scripting

Pass

Audited by Gen Agent Trust Hub on Jul 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The setup.py script clones the ida-domain repository from the author's official GitHub account (https://github.com/HexRaysSA/ida-domain.git) to set up the necessary environment.
  • [COMMAND_EXECUTION]: The run.py script executes Python-based analysis code generated by the agent. It writes the code to a temporary file in /tmp and runs it using the uv package manager.
  • [COMMAND_EXECUTION]: setup.py and run.py utilize standard developer tools including git and uv to manage dependencies and execute tasks via subprocess.run.
  • [PROMPT_INJECTION]: The skill processes external binaries for analysis, which represents a surface for indirect prompt injection if binary metadata or strings influence the agent's script generation.
  • Ingestion points: Target binary files provided to the -f argument in run.py.
  • Boundary markers: None explicitly used in the prompt construction for binary analysis.
  • Capability inventory: Full Python execution via run.py and environment management via setup.py.
  • Sanitization: No specific filtering of binary content is performed before processing.
  • [SAFE]: The automated scanner alert regarding curl ... | sh was found to be a false positive. The string appears within a print() statement in setup.py as a helpful instruction for users to manually install the uv tool if it is missing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 19, 2026, 06:15 AM
Security Audit — agent-trust-hub — ida-domain-scripting