0day-scanner
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data, specifically code diffs, pull request content, and file contents, which creates a significant surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context through commit SHAs, PR descriptions/diffs, file paths, and local reference packs at
../security-reviewer/. - Boundary markers: The instructions do not define clear delimiters or 'ignore' instructions to prevent the LLM from obeying commands embedded within the code changes being analyzed.
- Capability inventory: The agent can invoke the
analyze_for_zero_day_vulnerabilitiesMCP tool, perform REST API operations at/api/v1/zeroday/, and read files from the filesystem. - Sanitization: There is no evidence of sanitization or filtering of the ingested code content before it is processed by the LLM.
Audit Metadata