skills/jeremylongshore/tons-of-skills-marketplace/scanning-for-hardcoded-secrets/Gen Agent Trust Hub
scanning-for-hardcoded-secrets
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes local source code provided by the user, which may contain malicious instructions designed to influence the agent's interpretation of scan results.
- Ingestion points: The
scripts/scan_secrets.pyscript ingests file content viaPath.read_text(). - Boundary markers: No specific delimiters are used to separate untrusted file content from instructions, though the script processes input as data for regex matching.
- Capability inventory: The skill utilizes
Readfor file access andBash(python3:*)for script execution, with explicit restrictions on network tools (curl,wget) and file deletion (rm). - Sanitization: The
redact()function inscripts/scan_secrets.pymasks the middle of detected credentials in the output to mitigate secondary leaks.
Audit Metadata