sarif-tools
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSNO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing
sarif-toolsfrom PyPI using standard package managers. The tool is an official repository maintained by Microsoft. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and transformation of SARIF files, which represent an attack surface for indirect prompt injection if the files originate from untrusted sources.
- Ingestion points: SARIF data is loaded from local directories or glob patterns via CLI commands or the
loader.loader()Python function. - Boundary markers: The skill documentation does not specify the use of delimiters or instructions to ignore potential commands embedded in scan result messages.
- Capability inventory: The tool can perform file system writes to multiple formats (HTML, CSV, Word, JSON) and executes
git blameto retrieve commit information. - Sanitization: The skill relies on the underlying Microsoft library to handle data extraction and formatting from SARIF fields.
- [NO_CODE]: The skill is purely informational, providing usage patterns and documentation for the CLI tool without including additional scripts or binary files.
Audit Metadata