fuzzing
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the
atherisfuzzing engine viapipandafl++via the system package manager. It also references official documentation from trusted organizations including Google, LLVM, and the AFL++ project. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Fuzzing harness templates in
SKILL.md(e.g.,LLVMFuzzerTestOneInputandatheris.FuzzedDataProvider) are designed to ingest and process untrusted data streams. - Boundary markers: The harnesses correctly utilize
sizeandmax_sizeparameters to ensure memory safety within the target buffers. - Capability inventory: The skill involves the use of standard development tools such as
clang,cmake, and shell-based fuzzer execution environments. - Sanitization: As a fuzzing tool, the inputs are deliberately unsanitized to test the robustness of target parsers, which is the intended behavior.
- [COMMAND_EXECUTION]: The skill contains standard shell commands for compiling C/C++ code with sanitizers and executing fuzzing binaries. These are routine development operations within the context of security testing and do not demonstrate malicious intent.
Audit Metadata