using-static-analysis-engineering

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: Technical documentation in llm-assisted-rule-explanation.md contains examples of adversarial prompt strings (e.g., "IGNORE PREVIOUS INSTRUCTIONS") within a security threat model section. These are used strictly for educational purposes to demonstrate how to mitigate injection attacks in analyzed source code and do not represent a malicious attempt to subvert the agent's behavior.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes building agents that analyze untrusted source code, which represents a potential surface for indirect prompt injection. The documentation explicitly addresses this risk by detailing a mandatory mitigation framework, including the use of bounded code windows as ingestion points, delimited boundary markers, and a structured "Review Gate" that performs sanitization through grounding checks and schema validation.
  • [SAFE]: The skill consists of expert-level technical documentation for security engineering and shows no evidence of malicious intent, obfuscation, or unauthorized data exfiltration. All external library and service references are well-known industry standards consistent with the skill's educational purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 04:27 PM