arduino-project-builder
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data to generate code and project scaffolds, creating a vulnerability surface.
- Ingestion points:
scripts/scaffold_project.pyaccepts user-defined project names and types through command-line arguments derived from user requests. - Boundary markers: The scaffolding script does not employ boundary markers or instructions to disregard potential injection patterns when interpolating user data into generated code headers and comments.
- Capability inventory: The skill has the capability to create directories and write files to the local file system using the
pathlibmodule inscripts/scaffold_project.py. - Sanitization: The project name is sanitized for use in file system paths by replacing spaces with dashes, but the raw input is interpolated directly into C++ source code templates without escaping or validation.
Audit Metadata