trailmark-variant-neighborhood
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a structured workflow for variant analysis using standard development and search tools (Bash, Grep, Read). The logic is focused on legitimate security research tasks such as identifying shared callers, sinks, and interface implementations.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest vulnerability data ('seed findings') which may originate from external or untrusted sources. However, the skill includes explicit 'Stop Conditions' and a detailed 'Ranking' reference to filter and prioritize candidates, which serves as a mitigation against processing malformed or malicious injection attempts embedded in finding descriptions. As this is a vulnerability surface inherent to security analysis tools, it is noted but does not escalate the verdict.
- [COMMAND_EXECUTION]: The skill uses the 'Bash' tool to perform repository searches and graph queries. The instructions provide clear boundaries for these operations, limiting them to the scope of the analyzed codebase.
Audit Metadata