detecting-eval-exec-usage
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs static analysis using regular expressions to identify insecure APIs in source code. It does not execute or interpret the code it scans, effectively mitigating risks of code injection during the analysis process.\n- [SAFE]: The execution environment is restricted through frontmatter configuration that explicitly disallows network-capable tools (curl) and destructive commands (rm), ensuring that the skill's operations are contained and safe for the local environment.\n- [SAFE]: The security guidance provided in the theory and playbook files correctly identifies the high impact of CWE-95 (Eval Injection) and recommends industry-standard, sandboxed alternatives such as simpleeval, expr-eval, and Dentaku.
Audit Metadata