code-comment-guidelines
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is entirely composed of markdown instructions and guidelines. It does not contain any executable scripts, binary files, or commands that interact with the system or network in a hazardous way.
- [SAFE]: Tool access is explicitly restricted via 'allowed-tools' to 'Read', 'Grep', and 'Glob', minimizing the potential impact of instructions by preventing file-write or network operations.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze user-provided code, which represents a surface for indirect prompt injection. However, since the skill only provides text-based feedback and lacks high-privilege capabilities, this surface does not pose a significant risk. 1. Ingestion points: User-provided code snippets or files provided to the agent for review. 2. Boundary markers: None identified in the provided instructions. 3. Capability inventory: Limited to read-only search and file reading tools. 4. Sanitization: None present; the agent relies on its base safety filters for processing untrusted code content.
Audit Metadata