sast-configuration
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs several well-known security tools from recognized sources:
- Fetches the Semgrep package using
pip install. - Pulls the official SonarQube image using
docker run. - Installs the CodeQL extension via the GitHub CLI (
gh extension install). - References official Semgrep repositories and GitHub Actions.
- [COMMAND_EXECUTION]: The skill utilizes shell commands to perform setup and scanning tasks:
- System-level commands for package management and container execution.
- Execution of a local shell script
./scripts/run-sast.shused for automating the SAST workflow. - [INDIRECT_PROMPT_INJECTION]: The skill functions by analyzing external source code, which introduces a surface for indirect prompt injection.
- Ingestion points: The agent reads and processes application source code files for vulnerability detection.
- Boundary markers: The instructions do not specify delimiters or warnings for the agent to ignore instructions embedded in the code being scanned.
- Capability inventory: The skill executes shell-based scanning tools and generates local JSON report files.
- Sanitization: The skill does not explicitly define sanitization steps for the data ingested from the codebase.
Audit Metadata