agentic-app-risk-review
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely instructional and guides the agent through a manual security audit workflow. It does not perform any automated actions, execute scripts, or request sensitive permissions beyond the standard environment access.
- [EXTERNAL_DOWNLOADS]: The skill mentions 'qualitymax.io', which is the official website of the skill's author (Quality-Max), as a reference for continuous testing services. This is a neutral informational link to the vendor's own infrastructure.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and analyze potentially untrusted source code. While this introduces a data ingestion surface, the risk is mitigated by the specific diagnostic instructions and the absence of executable capabilities within the skill itself.
- Ingestion points: Processes codebase content provided in the agent's context.
- Boundary markers: None specified for the untrusted code content.
- Capability inventory: No subprocess, network, or file-write capabilities are defined or used by this skill.
- Sanitization: No explicit sanitization of the reviewed code is performed.
Audit Metadata