detect-static-dependencies
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection Surface: The skill is designed to ingest and analyze untrusted external data in the form of C# source code (
.cs), project files (.csproj), and solution files (.sln). - Ingestion points: Source files identified in the workspace or target path are read and searched for patterns (SKILL.md).
- Boundary markers: The instructions do not explicitly mandate the use of delimiters or specific "ignore embedded instructions" warnings when processing the contents of these files.
- Capability inventory: The skill utilizes file-listing, file-reading, and search tools such as
rg(ripgrep) orgrepto perform its analysis. - Sanitization: There are no explicit instructions for sanitizing or escaping the content of the files before the agent processes them for reporting.
- Diagnostic Tool Usage: The skill instructions allow for falling back to shell-based search utilities like
rgorgrepif standard file-reading tools fail. This is a common pattern for high-performance code scanning and is restricted to the workspace boundary.
Audit Metadata