clang-format
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill defines procedures for executing command-line tools such as
clang-format,diff, andchmod. Specifically, the style analysis workflow inSKILL.md(Trigger 2) instructs the agent to generate temporary configuration files in the/tmp/directory and run shell commands to verify their impact. This capability represents an indirect prompt injection surface. - Ingestion points: User-provided repository names and code samples (
SKILL.md). - Boundary markers: Absent; the instructions do not explicitly mandate delimiters for interpolated variables in shell commands.
- Capability inventory: Shell execution for formatting and diffing files (
SKILL.md). - Sanitization: Absent; there is no instruction to validate or escape inputs used in the construction of temporary file paths and subsequent shell commands.
- [EXTERNAL_DOWNLOADS]: The skill's documentation and integration examples in
SKILL.mdreference the use of thepre-commitframework and provide configuration snippets that fetch repository mirrors from GitHub (e.g.,github.com/pre-commit/mirrors-clang-format). These references are documented neutrally as standard configuration options for establishing automated formatting hooks.
Audit Metadata