cpp-pro
Fail
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references a documentation URL at jeffallan.github.io that has been blacklisted by automated security scanners. The skill also utilizes CMake's FetchContent to download the fmt library from its official GitHub repository, which is a standard procedure in C++ development but involves external code retrieval.
- [REMOTE_CODE_EXECUTION]: Reputation scanners have flagged the main skill entry file (SKILL.md) as malicious (FileRepMalware), indicating the file is associated with known threats.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a high attack surface for indirect prompt injection as it is designed to analyze, optimize, and debug external C++ source code and build scripts provided by the user.
- Ingestion points: The agent is instructed to read and process C++ source files, CMakeLists.txt files, and build logs.
- Boundary markers: The instructions lack delimiters or explicit guidance to ignore instructions that might be embedded within the source code or comments of the files being analyzed.
- Capability inventory: The skill employs significant system capabilities including build system execution (CMake), compilation, static analysis (clang-tidy, cppcheck), and performance profiling (perf, valgrind).
- Sanitization: The skill does not define mechanisms for sanitizing input or verifying the integrity of external source files before they are processed by the agent.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata