analyze-external-methods
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill operates on local project files within the .opentaint/ directory, primarily reading and writing YAML configuration files. No network exfiltration or unauthorized file access patterns were found.- [SAFE]: The bundled Python script, scripts/check-coverage.py, is a static utility that performs coverage checks using secure YAML parsing and standard library functions.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, establishing a potential attack surface for indirect prompt injection.
- Ingestion points: The agent reads the batch plan file (.opentaint/tracking/approximations/plans/.yaml), the dropped methods list (.opentaint/results/dropped-external-methods.yaml), and the source code of the external methods being analyzed.
- Boundary markers: The skill instructions do not specify the use of delimiters or 'ignore' warnings for the external content.
- Capability inventory: The agent performs file writes to the .opentaint/tracking/ directory and executes the local scripts/check-coverage.py script.
- Sanitization: No explicit sanitization or validation of the processed code or configuration content is implemented in the skill instructions.
Audit Metadata