code-review-cpp
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a documentation-based reference for security auditing. It contains no executable scripts, hardcoded credentials, or network exfiltration patterns.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a process for the agent to ingest and analyze untrusted C/C++ source code, which is an indirect prompt injection attack surface.
- Ingestion points: C/C++ source files (.c, .cc, .cpp, .h) and build configuration files (Makefile, CMakeLists.txt) as specified in SKILL.md.
- Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded prompts within the source code being reviewed.
- Capability inventory: The skill suggests executing static analysis tools (clang, cppcheck, semgrep) and dynamic analysis tools (ASan, libFuzzer).
- Sanitization: No sanitization or escaping mechanisms are provided for the code being processed.
Audit Metadata