static-application-security-testing
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands to execute various security scanners, including Semgrep, CodeQL, and Bandit, to perform analysis on source code repositories.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code, which serves as an ingestion point for potentially malicious instructions that could influence the agent during result interpretation.
- Ingestion points: External source code repositories provided by the user (SKILL.md).
- Boundary markers: Absent; the instructions do not define specific delimiters or warnings to isolate untrusted code from instructions.
- Capability inventory: The skill has command execution capabilities via several SAST CLI tools.
- Sanitization: Absent; the skill does not require sanitization or escaping of code snippets before including them in reports for agent review.
Audit Metadata