clang-format

Pass

Audited by Gen Agent Trust Hub on Mar 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill defines procedures for executing command-line tools such as clang-format, diff, and chmod. Specifically, the style analysis workflow in SKILL.md (Trigger 2) instructs the agent to generate temporary configuration files in the /tmp/ directory and run shell commands to verify their impact. This capability represents an indirect prompt injection surface.
  • Ingestion points: User-provided repository names and code samples (SKILL.md).
  • Boundary markers: Absent; the instructions do not explicitly mandate delimiters for interpolated variables in shell commands.
  • Capability inventory: Shell execution for formatting and diffing files (SKILL.md).
  • Sanitization: Absent; there is no instruction to validate or escape inputs used in the construction of temporary file paths and subsequent shell commands.
  • [EXTERNAL_DOWNLOADS]: The skill's documentation and integration examples in SKILL.md reference the use of the pre-commit framework and provide configuration snippets that fetch repository mirrors from GitHub (e.g., github.com/pre-commit/mirrors-clang-format). These references are documented neutrally as standard configuration options for establishing automated formatting hooks.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 29, 2026, 08:42 AM