sast-configuration
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to download and install standard security tools from well-known sources, such as Semgrep via pip, SonarQube via Docker, and the CodeQL extension for the GitHub CLI. These are established procedures for setting up security infrastructure.
- [COMMAND_EXECUTION]: Provides standard command-line examples for running security scans, initializing databases, and starting containerized services. These commands are typical for the described use case of setting up SAST tools.
- [INDIRECT_PROMPT_INJECTION]: As a configuration guide for code analysis tools, the workflow involves ingesting and analyzing untrusted application code.
- Ingestion points: Application source code is processed by the configured tools (Semgrep, SonarQube, CodeQL).
- Boundary markers: No specific delimiters or warnings for embedded instructions are provided in the configuration examples.
- Capability inventory: The skill involves installing packages, creating databases, and executing setup scripts.
- Sanitization: The instructions do not specify sanitization or filtering of the application code being analyzed.
Audit Metadata