hl-security-audit
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several local security scanning utilities, such as npm audit, semgrep, and gitleaks, to perform audits. These commands are executed in a read-only environment without network side effects.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes external codebases, creating a surface for indirect prompt injection via malicious comments or code. 1. Ingestion points: Accesses repository files like README, config, and source code. 2. Boundary markers: The skill uses an assume-malicious posture for all inputs. 3. Capability inventory: Execution of local auditing tools and writing a report file. 4. Sanitization: The skill mandates manual verification of high-priority findings by the agent to mitigate the risk of being misled by processed content.
Audit Metadata