using-static-analysis-engineering
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Technical documentation in
llm-assisted-rule-explanation.mdcontains examples of adversarial prompt strings (e.g., "IGNORE PREVIOUS INSTRUCTIONS") within a security threat model section. These are used strictly for educational purposes to demonstrate how to mitigate injection attacks in analyzed source code and do not represent a malicious attempt to subvert the agent's behavior. - [INDIRECT_PROMPT_INJECTION]: The skill describes building agents that analyze untrusted source code, which represents a potential surface for indirect prompt injection. The documentation explicitly addresses this risk by detailing a mandatory mitigation framework, including the use of bounded code windows as ingestion points, delimited boundary markers, and a structured "Review Gate" that performs sanitization through grounding checks and schema validation.
- [SAFE]: The skill consists of expert-level technical documentation for security engineering and shows no evidence of malicious intent, obfuscation, or unauthorized data exfiltration. All external library and service references are well-known industry standards consistent with the skill's educational purpose.
Audit Metadata