variant-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructional guidance for authorized security assessments and code auditing. It emphasizes user oversight through mandatory confirmation gates for all probing and extraction actions and includes prominent warnings regarding unauthorized use and legal compliance.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a vulnerability surface where the agent processes untrusted codebase data. 1. Ingestion points: Source code and configuration files are read by tools like ripgrep and Semgrep during the variant analysis process described in SKILL.md. 2. Boundary markers: The skill includes a 'Mandatory confirmation gate' that requires the user to confirm the target, scope, and command effects before proceeding. 3. Capability inventory: The methodology utilizes file-search (ripgrep) and analysis (Semgrep/CodeQL) tools. 4. Sanitization: The instructions do not specify automated sanitization for the analyzed code, relying instead on manual iterative triage to identify false positives and verify findings.
Audit Metadata