auditing-security
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a legitimate guide for security auditing, instructing the agent to identify risks like hardcoded credentials, SQL injection, XSS, and insecure dependencies. The instructions are aligned with standard security practices like the OWASP Top 10.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing external, untrusted codebases, which creates an attack surface for indirect prompt injection where instructions hidden in the audited code could attempt to mislead the audit output.
- Ingestion points: Source code files, environment configuration files (.env), and dependency manifests (package.json, requirements.txt) analyzed during the audit process in SKILL.md.
- Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the audited code as data and ignore any embedded instructions.
- Capability inventory: The skill focuses on analysis and does not contain scripts that execute shell commands or perform network operations, though it suggests the use of external tools like npm audit and snyk.
- Sanitization: No input sanitization or escaping techniques are specified for the code content being reviewed.
Audit Metadata