senior-secops
Pass
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute locally bundled Python scripts, including security_scanner.py, vulnerability_assessor.py, and compliance_checker.py. These tools automate technical security reviews of a project's source code and configuration.
- [PROMPT_INJECTION]: As a security auditing tool, this skill processes untrusted external data in the form of project source code and dependency files. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the code being analyzed.
- Ingestion points: User-provided project directories and package manifests (e.g., package.json, requirements.txt, go.mod).
- Boundary markers: The provided instructions do not specify delimiters or warnings to ignore embedded instructions in the analyzed data.
- Capability inventory: The skill performs local script execution and generates structured security reports.
- Sanitization: No explicit content sanitization or validation logic is described in the markdown documentation.
Audit Metadata