cwe-file-path-security
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [Indirect Prompt Injection Surface]: The skill is designed to ingest and analyze untrusted application source code to identify security flaws.
- Ingestion points: The skill systematically scans source files such as
.java,.py,.cs,.js, and.tswithin a target codebase. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard instructions that might be embedded within the source code being analyzed.
- Capability inventory: The skill identifies vulnerabilities and generates a structured JSON report. It does not possess capabilities for subprocess execution, file writing, or network operations.
- Sanitization: The instructions do not specify any sanitization or escaping of the external content before it is processed or included in the final output report.
Audit Metadata