vulnerability-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted source code, which serves as a primary input. This creates an inherent attack surface for indirect prompt injection, where malicious instructions could be embedded in the code being audited. The skill mitigates this through structured analysis processes and a dedicated validation harness (
scripts/validate_findings.py) to verify the exploitability of findings. - [COMMAND_EXECUTION]: The skill uses
subprocess.callinscripts/sast_runner.pyto execute external security analysis tools likecodeql,semgrep, andjoern. This is standard and necessary behavior for a tool designed to orchestrate static analysis engines. - [EXTERNAL_DOWNLOADS]: The
scripts/dep_audit.pyscript performs network requests to the Google Open Source Vulnerabilities (OSV) API (api.osv.dev) to query for known vulnerabilities in software dependencies. This is a well-known and trusted service within the security community.
Audit Metadata