semgrep
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents how to fetch security rules and configuration from external sources, including the official Semgrep registry and external URLs. It specifically references fetching rules from well-known security organizations and official tool repositories.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze untrusted source code, which constitutes a standard attack surface for indirect prompt injection.
- Ingestion points: Local source code files processed via the
semgrep scancommand. - Boundary markers: None explicitly mentioned in the skill instructions to delimit untrusted code from instructions.
- Capability inventory: The skill is permitted to use Bash, Read, Glob, and Grep tools to facilitate scanning and reporting.
- Sanitization: Security analysis results are typically returned in structured formats like SARIF or JSON to minimize interpretation errors.
Audit Metadata