vibe-code-auditor
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external source code provided by users, which creates an attack surface for indirect prompt injection where malicious content within the audited files could attempt to manipulate the audit report outcomes.
- Ingestion points: Source code snippets or files provided by the user in the conversation.
- Boundary markers: The skill does not explicitly mandate the use of delimiters (like triple backticks or XML tags) for input code, although it expects standard structural code input.
- Capability inventory: Static analysis and reporting only; the skill does not include instructions to execute code, perform network operations, or access the file system beyond reading the provided input.
- Sanitization: Includes explicit instructions to treat input as 'untrusted evidence' and to redact sensitive values like passwords or API keys before including them in the output report.
Audit Metadata