cc-skill-security-review
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze user-supplied code for security flaws, which creates a vector for indirect prompt injection if the code contains hidden malicious instructions.\n
- Ingestion points: The agent is directed by
SKILL.mdto handle user input, file uploads, and API endpoint implementations provided by the user.\n - Boundary markers: There are no specified delimiters or instructions provided to separate the user-provided code from the agent's internal operational guidelines.\n
- Capability inventory: The agent is tasked with reviewing logic, generating code corrections, and validating security protocols, which could be influenced by malicious code comments or identifiers.\n
- Sanitization: The skill does not provide mechanisms to sanitize or filter out instructions embedded within the analyzed content.
Audit Metadata