code-review-cpp
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructional content and reference patterns for security auditing. It does not include executable scripts, persistence mechanisms, or unauthorized network operations. Tools mentioned in the frontmatter, such as clang-analyzer and semgrep, are standard industry tools for the stated purpose.\n- [INDIRECT_PROMPT_INJECTION]: The skill instructions involve the processing of external C/C++ source code and pull requests, which creates an attack surface for indirect prompt injection.\n
- Ingestion points: The skill processes .c, .cc, .cpp, and .h files, as well as Makefile and CMakeLists content during source code reviews.\n
- Boundary markers: The instructions do not define specific delimiters or instructions to prevent the agent from following directions that might be embedded in the code being analyzed.\n
- Capability inventory: The methodology utilizes static analysis tools (cppcheck, clang-analyzer, semgrep), search tools (ripgrep), and suggests the use of fuzzers (libFuzzer, AFL++).\n
- Sanitization: No explicit sanitization or filtering of the source code content is performed before analysis.
Audit Metadata