attack-surface-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists exclusively of instructional documentation and YAML metadata; no executable scripts, binary files, or remote code download patterns are present in the provided file.
- [SAFE]: Evaluation of the skill's instructions and auto-activation triggers found no evidence of prompt injection attempts, deceptive metadata, or persistence mechanisms.
- [INDIRECT_PROMPT_INJECTION]: The skill provides an inherent vulnerability surface for indirect prompt injection due to its role in analyzing potentially untrusted security data.
- Ingestion points: The skill permits reading user requests and project files via the Read and Grep tools defined in SKILL.md.
- Boundary markers: No specific delimiters or instructions to ignore embedded commands are defined for the data being analyzed.
- Capability inventory: The skill metadata (SKILL.md) specifies the use of Bash, Write, and Edit for performing analysis tasks.
- Sanitization: No input filtering or validation mechanisms are implemented to mitigate instructions embedded in analyzed data.
Audit Metadata