clj-replace

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The Clojure script scripts/clj-replace.bb utilizes Babashka's deps/add-deps function to dynamically declare and download the rewrite-clj package version 1.1.47 from public registries at runtime. While the package version is explicitly pinned, retrieving dependencies dynamically at runtime introduces a reliance on external package repositories.
  • [INDIRECT_PROMPT_INJECTION]: The tool ingests untrusted files via standard file-reading operations (slurp) to perform structural comparisons. In scenarios where a search pattern matches multiple locations ambiguously, the tool prints the matching code blocks back to the standard output. If an attacker-controlled file contains natural language instructions within those blocks, it creates an indirect prompt injection surface when processed by an AI agent pipeline.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 11:37 AM
Security Audit — agent-trust-hub — clj-replace