security-review
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and reasoning about untrusted codebase data, which creates a surface for indirect prompt injection (Category 8). While the skill includes verification protocols, the interpolation of external code into the agent's context is an inherent risk.\n
- Ingestion points: The skill analyzes user-provided codebase paths and files starting from Step 1 (SKILL.md).\n
- Boundary markers: The 'Zero-Trust Verification' section explicitly instructs the agent to treat user-provided code as untrusted.\n
- Capability inventory: The skill generates security reports and proposes code patches for remediation (SKILL.md Step 7 and 8).\n
- Sanitization: There is no defined process for escaping or sanitizing external content before the agent processes it.\n- [REMOTE_CODE_EXECUTION]: Static analysis flagged code injection patterns (eval, exec) in references/language-patterns.md and references/vuln-categories.md. These are identified as benign documentation examples of vulnerabilities for the agent to recognize during its audit workflow, rather than executable code within the skill itself.\n- [EXTERNAL_DOWNLOADS]: The skill performs dependency audits by checking local project metadata against a curated watchlist (references/vulnerable-packages.md). It does not execute remote scripts or perform unauthorized external downloads.
Audit Metadata