ingest-cwe-taxonomies
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- External Resource Access: The skill is configured to fetch the official CWE database from MITRE's servers (cwe.mitre.org). This is a well-known and reputable source for security metadata.
- Indirect Prompt Injection Surface: The skill ingests and processes external XML data to generate taxonomies. While the source is a standard security repository, the ingestion of external corpora is an inherent characteristic of data processing skills.
- Ingestion points: MITRE's XML repository and user-provided local paths.
- Boundary markers: The skill workflow refers to a secondary prompt file for specific instruction boundaries.
- Capability inventory: The skill performs file system writes to
taxonomies/,data/, andscripts/directories, and updates a manifest file. - Sanitization: Sanitization logic is likely contained within the referenced ingestion script and prompt instructions.
- Script Generation: The workflow generates a Python ingestion script (
scripts/ingest-cwe.py) to handle the normalization and mapping phases, which is a common pattern for automating data transformations.
Audit Metadata