run-scan
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
opentaintCLI tool to perform security analysis. It passes parameters for project models, rulesets, and approximation directories to theopentaint scancommand. This is the primary and intended function of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes output files generated by the scan to provide findings to the user. While this involves reading external data, the risk is minimal as the skill only extracts metadata like finding counts and error reports.
- Ingestion points:
.opentaint/results/report.sarif,.opentaint/results/dropped-external-methods.yaml, and.opentaint/results/approximated-external-methods.yaml. - Boundary markers: None explicitly mentioned for the ingestion of tool outputs.
- Capability inventory: Shell command execution (
opentaint scan) and local file reading within the project scope. - Sanitization: Findings are summarized into numeric counts and engine-specific error messages.
Audit Metadata