blast-radius
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an inherent attack surface for indirect prompt injection because its core function involves processing untrusted inputs from the local repository and the external ecosystem to drive automated verification tasks.
- Ingestion points: Processes external repository data, pull request diffs, git history, developer specifications (ADRs), originating tickets, and external library source code (SKILL.md, Steps 1 & 2).
- Boundary markers: The instructions do not specify explicit delimiters or structural markers to isolate untrusted data from the agent's instructions, although it does mandate redacting private data and secrets in the final report (SKILL.md, Step 7).
- Capability inventory: The skill utilizes capabilities to execute repository scripts, CI configurations, and custom executable proofs to verify code safety (SKILL.md, Steps 3 & 4).
- Sanitization: No explicit sanitization or validation logic is defined for the external repository content or documentation before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill requires the agent to run local repository checks, CI configurations, and custom test scripts to verify the safety of changes (SKILL.md, Steps 3 & 4). This behavior is consistent with the primary purpose of code verification and safety analysis.
- [SAFE]: The optional model comparison functionality (COMPARISON.md) follows safe practices by explicitly instructing the agent not to install new tools, change authentication, or add paid access, relying instead on existing user-provisioned CLI tools (Claude/Codex).
Audit Metadata