detecting-weak-cryptography
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The
scripts/scan_weak_crypto.pyscript reads arbitrary files from a local directory and extracts code snippets to present as security findings. This creates a surface for indirect prompt injection, where malicious instructions hidden in source code comments or strings could potentially influence the agent's reasoning during the audit process. - Ingestion points: The script uses
Path.read_text()inscripts/scan_weak_crypto.pyto read contents from the target source tree. - Boundary markers: The findings generated by the script do not wrap the extracted code snippets in protective delimiters or provide explicit instructions for the agent to ignore any embedded commands.
- Capability inventory: The skill uses
Read,Glob,Grep, andBash(python3:*)to perform its analysis. - Sanitization: Code snippets are extracted directly from source files and included in the output without sanitization or escaping.
Audit Metadata