constant-time-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill executes a local Python analysis script (
analyzer.py) using theuvtool. This is the core functionality intended for static analysis of cryptographic source code. - [COMMAND_EXECUTION]: The instructions involve running standard development and security tools such as
gcc,clang,rustc,swiftc,javap, andilspycmd. These tools are used to compile or disassemble code for analysis across various programming languages (C, Rust, Java, C#, etc.). - [PERSISTENCE]: The documentation includes manual setup instructions for macOS users to add OpenJDK and .NET tools to their shell profile (
~/.zshrc). This is a standard configuration step for development environments and is not an automated or hidden persistence mechanism. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a static analyzer for user-provided source code. While it processes external files, the risk is limited as the data is analyzed for instruction timing patterns rather than being executed or interpolated into agent instructions without boundaries.
Audit Metadata