patcher
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the project being analyzed.
- Ingestion points: The agent is instructed in
SKILL.mdto gather vulnerability inputs from package manifests (package.json, pyproject.toml, etc.), lockfiles, Dockerfiles, and CI/CD configuration files. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when processing content from these external files.
- Capability inventory: The skill enables the agent to perform file-write operations (for patching) and execute shell commands (for auditing and verification) via
scripts/check-patcher.mjs. - Sanitization: The instructions do not require sanitization or validation of content found in the ingested files before it is processed by the LLM.
- Remediation: To mitigate this risk, external content should be wrapped in delimiters with an explicit 'ignore instructions' warning, and the skill should prefer structured data parsing with strict schema validation.
Audit Metadata