tldr-code
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted codebases, creating a vulnerability to indirect prompt injection.
- Ingestion points: Code files read via
tldr search,tldr extract, andtldr context. - Boundary markers: The instructions lack markers to distinguish code data from agent instructions.
- Capability inventory: The skill uses
Bashto execute commands, providing a significant capability surface. - Sanitization: No sanitization is specified for the code content returned by the tool.
- [EXTERNAL_DOWNLOADS]: The
tldr semantic indexcommand downloads embedding models (e.g.,bge-large-en-v1.5) from external repositories to enable semantic search capabilities. - [COMMAND_EXECUTION]: The skill leverages the
Bashtool to execute varioustldrCLI commands for navigating and querying the codebase.
Audit Metadata