django-verification
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of numerous shell commands to manage a Django environment, including code formatters (ruff, black), test suites (pytest), and Django management tasks (manage.py).
- [EXTERNAL_DOWNLOADS]: The skill instructs on installing various Python packages and security tools (pip-audit, safety) and mentions running npm dependency audits, which involve fetching data from external package registries.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface (Category 8) as it parses and reports on output from external tools like linters and test runners.
- Ingestion points: Processes output from ruff, bandit, pytest, and pip-audit (SKILL.md).
- Boundary markers: Absent; tool outputs are not wrapped in delimiters.
- Capability inventory: Executes subcommands like 'python manage.py', 'collectstatic', and 'pytest' (SKILL.md).
- Sanitization: No explicit sanitization or validation of tool output is defined before the agent incorporates it into its report.
- [CREDENTIALS_UNSAFE]: A management command example in Phase 6 includes a hardcoded password ('admin') for creating a test superuser. While intended for testing, it represents a hardcoded credential pattern.
Audit Metadata