clangd-lsp

Pass

Audited by Gen Agent Trust Hub on Nov 3, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external C/C++ source code files which represent untrusted data that could potentially contain malicious instructions.
  • Ingestion points: Source code files with extensions such as .c, .h, .cpp, .cc, .cxx, .hpp, .hxx.
  • Boundary markers: The instructions do not define specific delimiters to separate untrusted file content from agent instructions.
  • Capability inventory: The skill interacts with the file system and uses run_command to execute clangd for analysis.
  • Sanitization: There is no explicit sanitization of the source code or the diagnostics output generated by the language server.
  • [COMMAND_EXECUTION]: The skill instructs the agent to use run_command to execute the clangd binary for language diagnostics and symbol inspection, which is the intended functional purpose of the integration.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 3, 2026, 10:57 AM