codebase-triage
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill operates by analyzing the content of unfamiliar and potentially untrusted repositories, which introduces an indirect prompt injection surface.
- Ingestion points: The agent is instructed to read various files including root manifests (e.g., package.json, pyproject.toml), configuration files, READMEs, and source code directories to perform an inventory and health check (SKILL.md, Operating Principle 1).
- Boundary markers: The instructions lack explicit boundary markers or directions to ignore instructions that might be embedded within the files being analyzed.
- Capability inventory: The skill utilizes file-reading capabilities to examine repository structure and file contents.
- Sanitization: There is no mention of sanitization, filtering, or validation of the data ingested from the target codebase.
- [DATA_EXFILTRATION]: The skill involves scanning for and accessing sensitive file paths within the target codebase as a primary feature.
- Evidence: Step 3 of the instructions specifically directs the agent to scan for secrets committed to the repository, including ".env" files, keys, tokens, and credentials in source code. While intended for security auditing, this involves direct access to sensitive data patterns.
Audit Metadata