1k-auditing-pre-release-security
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code diffs from user-provided git references, creating a surface for indirect prompt injection.
- Ingestion points: Source code diffs and file contents are extracted in
SKILL.md(Steps A, B, G) and passed to theAgenttool in Step I.1. - Boundary markers: The prompt in Step I.1 lacks delimiters to separate instructions from the
${FULL_DIFF}content. - Capability inventory: The skill can execute shell commands (
git,yarn), write to the filesystem, and dispatch subagents. - Sanitization: There is no evidence of data sanitization or escaping for the diff content before it enters the AI context.- [COMMAND_EXECUTION]: The skill performs local command execution using
git,yarn, andosv-scannerto gather project metadata and perform security checks. These operations occur within the agent's execution environment.- [EXTERNAL_DOWNLOADS]: In Step D, the skill executesyarn install(with--immutableor--frozen-lockfile) to verify the lockfile. This involves downloading packages from remote registries and may trigger execution of lifecycle scripts defined in the repository's dependencies before they are audited in Step F.
Audit Metadata