repo-explore
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from external Git repositories.
- Ingestion points: Untrusted content enters the agent's context through the
git clonecommand and is subsequently read using tools likerg,find, andls(SKILL.md). - Boundary markers: The instructions do not define clear boundaries or provide warnings to the agent to ignore potential instructions found within the codebase being explored.
- Capability inventory: The agent has access to several shell tools (
git,rm,find,rg, etc.) which could be targets for manipulation if the agent's logic is subverted by malicious repository content. - Sanitization: There is no evidence of sanitization or filtering applied to the content of the cloned files before they are presented to the agent.
- [EXTERNAL_DOWNLOADS]: The skill is designed to download external source code from user-provided URLs using the
git clonecommand. This is a core feature of the skill but involves fetching content from untrusted remote sources.
Audit Metadata