security-review
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a professional security methodology covering scope definition, automated scanning, manual code review, and prioritized reporting.
- [SAFE]: Ethical constraints are clearly defined, requiring written authorization before testing and limiting exploits to proof-of-concept demonstrations.
- [SAFE]: Standard security tooling (e.g., semgrep, trivy, npm audit) is used appropriately for its intended purpose without suspicious remote execution patterns.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted codebases as part of its auditing function. While this creates a surface for indirect instructions, the focus on objective analysis and structured reporting mitigates risk. 1. Ingestion points: User-provided codebase and environment metadata (read from startup-context). 2. Boundary markers: Absent. 3. Capability inventory: Use of CLI-based security scanning tools. 4. Sanitization: Absent.
Audit Metadata