money-quality
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to process untrusted data, including source code diffs and content from live web applications. This creates a potential attack surface where malicious instructions hidden in the reviewed content could influence the agent's output or actions. \n
- Ingestion points: Analysis of staged code diffs and interaction with web applications during functionality testing. \n
- Boundary markers: There are no explicit instructions to treat the analyzed code as data only or to ignore any instructions found within that code. \n
- Capability inventory: The skill facilitates shell command execution (npx, python, go) and file system access to project configurations and source files. \n
- Sanitization: No validation or sanitization routines are specified for handling the content of the files or applications being audited. \n- [COMMAND_EXECUTION]: The skill incorporates the use of standard development and security tools via shell commands, such as npx (for tsc and eslint), python (for mypy and ruff), and go (for vet and golangci-lint).
Audit Metadata