owasp-security-review
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is purely informational and instructional, providing guidance for security reviews based on OWASP standards. It does not execute code, perform network requests, or request access to sensitive local resources.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze potentially untrusted source code provided by users. Ingestion points: Source code and architecture descriptions provided in SKILL.md workflows. Boundary markers: The workflow mandates systematic checks against specific internal reference files (references/*.md), which provides a structured frame for the agent's reasoning. Capability inventory: No tools (network, filesystem, or shell) are enabled in the frontmatter, limiting the potential impact of any injection. Sanitization: Not present; the skill relies on the agent's internal safety guardrails and the structured review process.
Audit Metadata