recon
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the target repository, which creates a potential surface for indirect prompt injection. \n
- Ingestion points: Files within the target repository, including manifests, source modules, and documentation (referenced in the Memory and Locate sections). \n
- Boundary markers: The skill enforces strict structural constraints on its output, limiting headings to 10 bullets and the total summary to 200 lines, which provides functional delimitation of external content. \n
- Capability inventory: The skill uses file system read access for mapping, file system write access for internal memory (located outside the target repository), and retrieves Git metadata such as HEAD and commit history. \n
- Sanitization: While no explicit content sanitization is described, the requirement to summarize findings and prune information acts as a filter against direct execution of instructions embedded in the source code.
Audit Metadata