cosmos-vulnerability-scanner
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs local analysis of source code using standard pattern-matching tools like
grep. No unauthorized network connectivity or data exfiltration was observed. - [SAFE]: All external references and recommended tools, such as CodeQL and the Cosmos SDK documentation, are reputable industry standards for blockchain and software security.
- [PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface because it reads and processes untrusted source code for analysis. Maliciously crafted comments or strings within the scanned files could attempt to influence the agent's security report or recommendations.
- Ingestion points: Reads Go, Protobuf, and Rust source files throughout the project directories as defined in the scanning workflow (SKILL.md).
- Boundary markers: None identified. The skill does not define clear delimiters or instruct the agent to ignore instructions embedded in the ingested code.
- Capability inventory: File reading, pattern matching via
grep, and security reporting/remediation advice. - Sanitization: There is no evidence of sanitization or filtering of the ingested file content before it is processed by the agent.
Audit Metadata