ai-code-security
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely educational and defensive in nature, providing security engineers with patterns for output validation, sandboxing, and vulnerability diagnosis.
- [PROMPT_INJECTION]: Static analysis triggers for instruction overrides are false positives; the skill uses grounding instructions to ensure the agent prefers provided security patterns over generic training data. Additionally, the skill includes explicit defense mechanisms (regex filtering) to detect and block prompt injection attempts.
- [DATA_EXFILTRATION]: No exfiltration patterns or suspicious network activity were detected. The skill includes a 'SecretDetector' implementation designed to find and redact hardcoded credentials like AWS keys and tokens in processed code.
- [COMMAND_EXECUTION]: The skill provides defensive code examples for 'Sandboxed Code Execution' using established tools like
firejailandvm2to prevent unsafe execution of AI-generated code. - [EXTERNAL_DOWNLOADS]: The skill references well-known trusted organizations (Anthropic, OpenAI, and Hugging Face) as whitelisted sources for model verification and supply chain integrity.
- [DYNAMIC_EXECUTION]: The skill documents the risks of
eval()andFunction()in AI-generated code and provides validation rules to detect and prevent their use.
Audit Metadata