evidence-code-audit
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed as a read-only diagnostic tool for local files. It includes explicit instructions to never execute code, start services, or invoke remote APIs.
- [CREDENTIALS_UNSAFE]: The skill contains robust safety instructions regarding secrets. It mandates the redaction of all credentials before they enter any output or report and forbids dumping environment variables or secret files.
- [EXTERNAL_DOWNLOADS]: The skill references an external GitHub repository (XiNian-dada/Fuck_My_Shit_Mountain) for provenance and licensing purposes. However, it explicitly states that no packages or external downloads are required or allowed during the audit process.
- [PROMPT_INJECTION]: The 'Read-only and secret-handling boundary' section provides clear instructions for the AI agent to ignore instructions embedded within the analyzed repository text that might attempt to trigger command execution or scope changes, effectively mitigating indirect prompt injection risks.
Audit Metadata