security-bounty-hunter
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate instructions and workflows for security auditing. No malicious patterns such as prompt injection, data exfiltration, or persistence mechanisms were detected.
- [COMMAND_EXECUTION]: The skill suggests the use of semgrep for static analysis in SKILL.md. This is a standard tool for identifying vulnerabilities and is appropriate for the skill's stated purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to audit untrusted code. 1. Ingestion points: Repository source code. 2. Boundary markers: None explicitly mentioned in the skill instructions. 3. Capability inventory: Shell execution via semgrep in SKILL.md. 4. Sanitization: Instructions emphasize manual code path verification and proving exploitability to confirm impact.
Audit Metadata