clangd-lsp
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external C/C++ source code files which represent untrusted data that could potentially contain malicious instructions.
- Ingestion points: Source code files with extensions such as .c, .h, .cpp, .cc, .cxx, .hpp, .hxx.
- Boundary markers: The instructions do not define specific delimiters to separate untrusted file content from agent instructions.
- Capability inventory: The skill interacts with the file system and uses
run_commandto executeclangdfor analysis. - Sanitization: There is no explicit sanitization of the source code or the diagnostics output generated by the language server.
- [COMMAND_EXECUTION]: The skill instructs the agent to use
run_commandto execute theclangdbinary for language diagnostics and symbol inspection, which is the intended functional purpose of the integration.
Audit Metadata