security-best-practices
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill is explicitly designed to read a user's codebase and identify security vulnerabilities. This involves high-privilege read access to the local filesystem, which is necessary for its primary function of generating a security report.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user's codebase (source files, configuration, and comments). This creates a surface for indirect prompt injection where malicious instructions embedded in the code could attempt to bias the security review. However, the skill mitigates this by relying on its own internal, structured reference documentation for normative requirements (MUST/SHOULD).
- [COMMAND_EXECUTION]: The skill instructions allow the agent to perform code fixes and git commits based on the security findings. It is mandated to follow existing project workflows, testing procedures, and commit message conventions to minimize the risk of introducing regressions or unauthorized changes.
Audit Metadata