django-verification
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: Phase 6 contains a command snippet for creating a superuser with the hardcoded password 'admin'. While intended for local test environments, this practice introduces a risk of credential exposure if accidentally applied to production-ready systems.
- [COMMAND_EXECUTION]: The skill makes extensive use of shell commands and Python management commands (e.g., python manage.py, pytest, ruff, bandit) to perform system-level verification and database operations.
- [PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted project data, such as git diffs, test logs, and coverage reports (ingestion points: local file system). There are no explicit boundary markers or sanitization logic (sanitization: absent) to prevent instructions within the codebase from influencing agent behavior. The skill has broad execution capabilities (capability inventory: pytest, git, python, npm), representing an indirect prompt injection surface.
Audit Metadata