engineering-security-engineer
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's documentation references well-known security tools and GitHub Actions from established organizations such as Semgrep, Aqua Security, and Gitleaks. These are standard industry tools for static analysis, dependency scanning, and secret detection.
- [PROMPT_INJECTION]: The skill is designed to analyze external data such as source code and application architectures, which creates a surface for indirect prompt injection. However, the skill includes defensive instructions and follows security best practices.
- Ingestion points: Source code and architecture descriptions provided for review in SKILL.md.
- Boundary markers: Instructions explicitly state to 'Always assume user input is malicious — validate and sanitize everything at trust boundaries'.
- Capability inventory: The skill uses a bash wrapper (run.sh) to execute a local Python-based runner (run-skill.py).
- Sanitization: Documentation emphasizes input validation and sanitization using libraries like Pydantic and regular expressions.
Audit Metadata