code-to-context
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository data, creating a surface for indirect prompt injection.
- Ingestion points: The agent reads file contents across the repository using tools like
cat,head,tail,grep, andrgas described inSKILL.md. - Boundary markers: The skill uses specific evidence labels (
[Observed],[Inferred],[Unknown]) and Markdown comment markers (<!-- phat:code-to-context:start -->) to isolate generated content. - Capability inventory: The agent can write to the local filesystem (specifically
CONTEXT.md) usingscripts/update_context.pyand execute shell discovery commands. - Sanitization: The instructions include robust guidelines to exclude dependency folders (
node_modules), redact credentials, and avoid inspecting live secret files like.envor SSH keys. - [COMMAND_EXECUTION]: The skill relies on executing local shell commands for repository discovery.
- Evidence: Instructions permit the use of
ls,find,git,grep, andrgto gather facts about the codebase. - Safeguards: There is an explicit prohibition on executing project-specific code (e.g.,
npm install,pytest,cargo build) or contacting external services during the discovery phase to prevent accidental code execution or side effects.
Audit Metadata