repo-intake-and-plan
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external repositories, specifically README files and Python script content.
- Ingestion points: The scripts
scripts/scan_repo.pyandscripts/extract_commands.pyread file lists and content from a user-specified repository path. - Boundary markers: The skill's operational scope is explicitly limited to scanning and planning; it is prohibited from environment setup or command execution, which mitigates the risk of executing injected commands.
- Capability inventory: Analysis of the scripts confirms they only perform file read operations and regex matching. There are no calls to
subprocess,os.system,eval, or any network-enabled libraries. - Sanitization: The extraction logic identifies non-runnable commands containing placeholders (e.g.,
<VARIABLE>), which prevents the agent from mistakenly treating them as verbatim instructions.
Audit Metadata