audit
Pass
Audited by Gen Agent Trust Hub on Mar 27, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks as it processes external, untrusted code provided by users.
- Ingestion points: User-provided code snippets, PR diffs, and module source files as specified in Step 1 of the auditing SOP.
- Boundary markers: No explicit delimiters or boundary markers are defined to isolate untrusted code from the agent's instructions.
- Capability inventory: The agent is instructed to perform shell-based operations including searching with grep and running analysis tools.
- Sanitization: No sanitization or escaping of input code is performed prior to the agent's analysis.
- [COMMAND_EXECUTION]: The skill directs the agent to execute various shell-based commands to perform auditing and static analysis tasks.
- Evidence: Step 3 and Step 4 provide specific commands such as
grep,ruff check,pytest --cov,pip-audit, andnpm auditto be run on the target codebase.
Audit Metadata