security-audit-codebase
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard Bash commands including grep and git to search for security patterns, check for tracked sensitive files, and verify configuration settings within the local codebase. These are legitimate auditing actions.
- [EXTERNAL_DOWNLOADS]: The skill invokes well-known security auditing tools such as npm audit, npx audit-ci, pip-audit, and safety check. These tools interact with official package registry vulnerability databases to perform their function and are standard in the industry.
- [PROMPT_INJECTION]: The skill processes untrusted codebase files, creating a surface area for indirect prompt injection.
- Ingestion points: Content is ingested from the audited codebase using Grep, Glob, and Read tools as specified in SKILL.md.
- Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions embedded within the codebase files.
- Capability inventory: The skill has access to Bash, Write, and Edit tools, which could potentially be misused if the agent is manipulated by malicious content in the files being audited.
- Sanitization: No sanitization or input validation logic is present for the files being analyzed. This vulnerability surface is noted as an inherent risk of codebase auditing.
Audit Metadata