code-reader-v2-cn
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill lacks sufficient safeguards against indirect prompt injection when processing untrusted project source code. While it implements complex analysis workflows and sub-agent management, it does not instruct the agent to distinguish between code logic and potentially malicious natural language instructions embedded in comments or strings.
- Ingestion points: The skill is designed to read and process all files within a project directory as seen in 'Step 1: Itemize all files' and the sub-agent '强制执行步骤' in the Deep Mode workflow.
- Boundary markers: There are no explicit boundary markers or 'ignore' directives provided to the agent or its sub-agents to separate the analyzed code content from the instruction context.
- Capability inventory: The skill uses tools to read arbitrary files, write analysis results to the filesystem, and spawn sub-agents to execute tasks, creating a chain where malicious data could influence file-write operations or sub-agent behavior.
- Sanitization: No sanitization, escaping, or filtering of the source code content is specified before the data is passed to the LLM for reasoning.
Audit Metadata