project-understanding
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses established software development tools for analysis, such as
npm audit,pip-audit, andlizard. These are industry-standard utilities for code auditing. - [SAFE]: The skill references official and trusted GitHub Actions (
actions/checkout,actions/github-script) in its documentation examples. - [PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external codebase data, creating a potential surface for indirect prompt injection. This is an inherent property of automated code analysis tools.
- Ingestion points: Project configuration files (e.g.,
package.json,tsconfig.json) and source files from the target repository. - Boundary markers: None specified; the prompt templates do not include explicit instructions to ignore embedded commands in analyzed files.
- Capability inventory: Performs file reads and executes standard analysis commands using
npm,pip, andgrep. - Sanitization: Relies on default agent processing; no specific sanitization steps are defined.
Audit Metadata