secret-scanner
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides automated assistance for security fundamentals and secret scanning. The instructions and examples focus on generating production-ready configurations and following industry best practices. No malicious code, prompt injections, or unauthorized network operations were detected in the skill definition.
- [INDIRECT_PROMPT_INJECTION]: The skill operates as a scanner for codebase content triggered by keywords like 'secret', creating a potential ingestion point for indirect prompt injections. However, no evidence of malicious exploitation or instruction bypass patterns was found, and the risks are mitigated by platform-level guardrails.
- Ingestion points: External codebase files and user requests containing secret-related triggers.
- Boundary markers: None explicitly defined in instructions.
- Capability inventory: Read, Write, Grep, and Bash(npm).
- Sanitization: None explicitly defined in instructions.
Audit Metadata