advpl-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text in the form of existing ADVPL/TLPP source code provided by users for code review and auditing. If an attacker injects malicious instructions inside code comments or string literals within that source code, it could attempt to influence the agent behavior.
- Ingestion points: User-supplied ADVPL/TLPP code files processed during runtime execution (
SKILL.md). - Boundary markers: Absent; the prompt does not establish strict encapsulation boundaries or instructions to treat the analyzed code strictly as data.
- Capability inventory: No tools, command lines, file system modifications, or network requests are executed by this skill.
- Sanitization: No sanitization, escaping, or structural validation is implemented on the incoming source code strings.
Audit Metadata