zig-cinterop
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external C header files using the
zig translate-ccommand, which establishes an attack surface for indirect prompt injection where malicious header content could attempt to influence the agent's behavior. - Ingestion points: C header files processed via shell commands (e.g.,
/usr/include/stdio.h,mylib.h) inSKILL.mdandreferences/translate-c-guide.md. - Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are provided when handling these external files.
- Capability inventory: Shell command execution via the
zigCLI and local file system access (read/write). - Sanitization: No sanitization or validation of the input headers is implemented.
- [COMMAND_EXECUTION]: Facilitates the use of the
zigCLI toolchain for tasks such as header translation (zig translate-c) and project compilation (zig cc). These are standard development operations consistent with the skill's primary purpose.
Audit Metadata