tech-debt-tracker
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: Hardcoded dummy credentials were found in the skill's asset directory, which contains sample code for testing the scanner functionality. These are synthetic test vectors and not production secrets.\n
- Evidence: assets/sample_codebase/src/frontend.js contains 'API_KEY = "abc123def456"'.\n
- Evidence: assets/sample_codebase/src/payment_processor.py contains Stripe and PayPal test keys.\n
- Evidence: assets/sample_codebase/src/user_service.py contains 'DATABASE_URL = "postgresql://user:password123@localhost:5432/mydb"'.\n- [INDIRECT_PROMPT_INJECTION]: The debt scanner processes untrusted codebase data, creating a potential surface for indirect prompt injection.\n
- Ingestion points: The scripts/debt_scanner.py tool reads all files in a user-provided directory.\n
- Boundary markers: Absent; reports are generated without explicit delimiters for scanned content.\n
- Capability inventory: The tools perform static analysis and local file I/O; they do not have network access or administrative execution capabilities.\n
- Sanitization: Absent; the tool does not escape or filter code content extracted during the scanning process.
Audit Metadata