graphicode-qa-linter

Pass

Audited by Gen Agent Trust Hub on May 9, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXFILTRATION]: The skill is designed for local linting. It uses the cat command to read project configuration, flow YAMLs, and source code files, but it does not utilize any network tools or instructions to transmit data externally.
  • [COMMAND_EXECUTION]: Shell commands are limited to safe, read-only operations using cat. There are no instances of arbitrary command execution, privilege escalation (like sudo), or unsafe argument interpolation that could lead to command injection.
  • [REMOTE_CODE_EXECUTION]: The skill performs static analysis (linting) and does not download external scripts, install unverified packages, or use dynamic execution functions like eval or exec on the code it reads.
  • [PROMPT_INJECTION]: The instructions provide a robust technical framework for validation. There are no attempts to override system prompts, bypass safety filters, or use adversarial role-play techniques.
  • [SAFE]: The skill's behavior is consistent with its stated purpose as a code linter, adhering to the principle of least privilege by only requesting read access to relevant project files.
Audit Metadata
Risk Level
SAFE
Analyzed
May 9, 2026, 06:33 AM
Security Audit — agent-trust-hub — graphicode-qa-linter