detect-static-dependencies

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • Indirect Prompt Injection Surface: The skill is designed to ingest and analyze untrusted external data in the form of C# source code (.cs), project files (.csproj), and solution files (.sln).
  • Ingestion points: Source files identified in the workspace or target path are read and searched for patterns (SKILL.md).
  • Boundary markers: The instructions do not explicitly mandate the use of delimiters or specific "ignore embedded instructions" warnings when processing the contents of these files.
  • Capability inventory: The skill utilizes file-listing, file-reading, and search tools such as rg (ripgrep) or grep to perform its analysis.
  • Sanitization: There are no explicit instructions for sanitizing or escaping the content of the files before the agent processes them for reporting.
  • Diagnostic Tool Usage: The skill instructions allow for falling back to shell-based search utilities like rg or grep if standard file-reading tools fail. This is a common pattern for high-performance code scanning and is restricted to the workspace boundary.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 05:47 PM