fp-check
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill includes instructional guardrails designed to prevent the AI from taking shortcuts or making assumptions. These constraints, such as the 'Rationalizations to Reject' section in 'SKILL.md', are safety-enhancing measures that ensure rigorous evidence-based analysis rather than attempts to bypass security filters.- [COMMAND_EXECUTION]: The skill framework facilitates the creation of Proof-of-Concept (PoC) code to demonstrate vulnerabilities. This is a core functional requirement for security verification and is supported by instructions in 'deep-verification.md' and 'evidence-templates.md' that emphasize the use of pseudocode, data flow diagrams, and unit tests to validate findings.- [INDIRECT_PROMPT_INJECTION]: By design, the skill processes untrusted user claims about security bugs, which represents an indirect injection surface. The skill mitigates this risk through a comprehensive 'Devil's Advocate' review phase and a six-gate verification process defined in 'gate-reviews.md', requiring documented evidence for reachability, impact, and mathematical feasibility before a verdict is reached. Evidence Chain: 1. Ingestion points: User requests for bug verification in 'SKILL.md'. 2. Boundary markers: Not explicitly defined for raw input. 3. Capability inventory: Data flow tracing, subagent delegation, and PoC generation. 4. Sanitization: Replaced by logical verification gates.
Audit Metadata