security-app-fuzzing
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill implements best practices for security testing, including explicit sensitive data handling rules and prohibitions against offensive use.
- [COMMAND_EXECUTION]: The skill provides numerous CLI commands for compiling and running fuzzers across various ecosystems (C++, Rust, Python, Go, JS). These are legitimate development and security testing operations necessary for the skill's function.
- [EXTERNAL_DOWNLOADS]: Instructions are provided for installing well-known security tools (e.g., Atheris, Jazzer, fast-check) from standard registries like npm and PyPI. It also references reputable sources such as Google's ClusterFuzzLite and OWASP.
- [INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risk of processing untrusted data (mutated fuzzer inputs or LLM outputs) and provides mitigation strategies, such as stubbing side effects during testing and using automated redaction for outputs containing sensitive information.
Audit Metadata