cwe-credentials-secrets
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill identifies and processes application source code, which constitutes a surface for indirect prompt injection. Maliciously crafted code or comments within the analyzed files could attempt to influence the agent's assessment or output. This is an inherent risk factor for any tool performing automated code analysis, rather than a specific flaw in the skill's logic.
- Strict Output Schema: The use of a mandatory JSON structure for reporting findings helps maintain the integrity of the results and reduces the likelihood of the agent's output being diverted by content found within the target codebase.
- Passive Analysis Role: The skill is explicitly defined as an auditor rather than a developer, which limits its operational scope and prevents it from attempting to modify the codebase or implement potentially unsafe fixes.
Audit Metadata