workflow-audit
Pass
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses bash, grep, sed, and awk to perform local analysis of the project's source code. These commands are confined to the project's directory and are essential for its auditing functions.
- [DATA_EXFILTRATION]: All analysis is performed locally on the project filesystem. There are no network requests, URL references to untrusted domains, or data transmission patterns identified.
- [PROMPT_INJECTION]: As a static analysis tool, the skill processes untrusted user source code. While this creates a theoretical surface for indirect prompt injection, the risk is mitigated by the highly structured nature of the auditing instructions and reporting requirements.
- [SAFE]: The skill does not perform any unverifiable downloads, remote code execution, privilege escalation, or persistence mechanism installations. It operates as a transparent development utility.
Audit Metadata