code-maturity-assessor
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted codebase data provided by the user, as described in Phase 1: Discovery in SKILL.md. This process creates a surface for indirect prompt injection where malicious instructions embedded in code or comments could attempt to bias the maturity scorecard. Evidence: Ingestion occurs when the agent explores and reads files in the target project. Boundary markers and sanitization steps are absent. Capability inventory includes the ability to search and read files across the codebase. The skill partially mitigates this risk by requiring the agent to provide specific file and line evidence for every rating, allowing the user to verify findings.
Audit Metadata