common-security-audit
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, including source code, configuration files, and logs across multiple programming languages and platforms. This surface allows for potential indirect prompt injection attacks where malicious instructions could be embedded in the audited files.\n
- Ingestion points: The skill instructions and metadata trigger the processing of various project files such as
package.json,go.mod,pom.xml, and source code directories.\n - Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat audited file content as data only or to ignore instructions found within those files.\n
- Capability inventory: The skill leverages powerful capabilities including recursive file searching (
grep), execution of dependency audit tools (npm audit,pip-audit,cargo audit), and framework-specific route counting.\n - Sanitization: No evidence of content sanitization, validation, or filtering is present before the agent processes external data sources.
Audit Metadata