recon-github-code-leaks
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze data from external, untrusted sources such as public GitHub/GitLab repositories and gists, creating an attack surface for indirect prompt injection where an attacker could place malicious instructions in commit messages or code files.
- Ingestion points: Public repositories, commit history, and gists identified during the footprint mapping and dorking phases (SKILL.md).
- Boundary markers: The instructions do not provide specific delimiters or instructions to ignore or isolate embedded prompts within the retrieved code or metadata.
- Capability inventory: The agent is guided to clone repositories and run security scanners (trufflehog, gitleaks, gitrob) on the contents, and to execute commands such as
sts get-caller-identityto verify discovered credentials. - Sanitization: No sanitization, filtering, or validation of the external repository content is specified before the agent performs its analysis.
Audit Metadata