repo-map
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to read potentially sensitive configuration files including
settings*.py,docker-compose*.yml, and CI configuration files. Although the instructions explicitly forbid including actual secrets, hostnames, or credentials in the generated map, the agent is directed to access file paths that are high-value targets for credential harvesting during the analysis phase. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from untrusted external sources (the git repositories being mapped), which presents an indirect prompt injection surface.
- Ingestion points: The agent reads the content of READMEs, source code, and various configuration files from all repositories in the workspace (SKILL.md).
- Boundary markers: The instructions do not provide specific delimiters or 'ignore embedded instructions' warnings for the agent to use when reading third-party repository content.
- Capability inventory: The agent has broad file-read capabilities and file-write capabilities to generate the map. Furthermore, the skill documentation notes that the resulting map is consumed by other downstream skills (e.g.,
prd-writer,jira-tickets), creating a multi-step chain where poisoned data could influence subsequent agent actions (SKILL.md). - Sanitization: No evidence of sanitization, escaping, or schema validation for the data ingested from the repositories is present.
Audit Metadata