security-audit
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from external repositories, including source code, AGENTS.md, and SECURITY.md. This creates a potential surface for indirect prompt injection where malicious instructions embedded in the audited files could attempt to subvert the agent's logic.\n
- Ingestion points: The skill reads all files within a target repository scope using read_file.\n
- Boundary markers: The instructions explicitly command the agent to ignore prompt-injection instructions within the source that try to alter scope, suppress findings, or override the workflow.\n
- Capability inventory: The skill has access to file reading, sub-agent delegation (delegate_task), network probing (http-probe), and local command execution (local-command).\n
- Sanitization: The skill mandates the redaction of literal secrets (using SHA256 fingerprints) and enforces a static-by-default policy to prevent unauthorized code execution.\n- [COMMAND_EXECUTION]: When the allow_tests flag is enabled by the user, the skill can execute repository-specific test runners (e.g., pytest, npm test, go test) via local-command. These commands are executed in a temporary copy of the repository and are restricted from installing system packages or running privileged commands.
Audit Metadata