offensive-ai-security
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to perform security assessments on external source code, binaries, and web bundles, which inherently involves the ingestion of untrusted data into the agent's context.
- Ingestion points: The workflow identifies entrypoints and trust boundaries through 'source search / REA binary & bundle inspection' as described in SKILL.md.
- Boundary markers: There are no explicit instructions or delimiters provided to ensure the agent ignores embedded instructions within the audited files.
- Capability inventory: The skill utilizes several tools for analysis and verification, including 'rg' (ripgrep) for static search, 'npm test' for remediation verification, and various REA-branded binary disassembly and recovery tools.
- Sanitization: The methodology does not include specific steps for sanitizing or escaping the content of external files before processing or interpolation.
Audit Metadata