cpp-move-semantics
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the review and debugging of C++ source code supplied by the user. Because this code is subsequently compiled and executed as part of the verification workflow, it creates an attack surface where instructions embedded within the user-provided code could attempt to manipulate the agent's behavior during the review process.\n
- Ingestion points: User-provided C++ source code for analysis and debugging (SKILL.md).\n
- Boundary markers: Absent; there are no specific instructions or delimiters used to isolate the user code from the agent's control logic.\n
- Capability inventory: Shell command execution via
g++and direct execution of generated binaries (./out) (SKILL.md, evals/README.md).\n - Sanitization: None; the skill does not perform any validation or sanitization on the code content before processing it.\n- [COMMAND_EXECUTION]: The skill provides the agent with instructions to execute shell commands to compile and run C++ programs. While this is an intended function for the skill's purpose, it represents a capability that involves subprocess execution and the running of local binaries.\n
- Evidence: Shell commands for
g++compilation and binary execution are provided in the verification sections of SKILL.md and evals/README.md.\n- [DYNAMIC_EXECUTION]: The skill utilizes runtime compilation to validate the behavior of C++ code examples. This involves the dynamic generation and execution of machine code from source files.\n - Evidence: The 'How to verify' section in SKILL.md and the verification facts in evals/README.md explicitly document the use of a compiler at runtime to validate code semantics.
Audit Metadata