parsing-source

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data by parsing source files or stdin input.
  • Ingestion points: File paths passed to ts-pack parse and data piped from stdin as seen in SKILL.md.
  • Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the command examples.
  • Capability inventory: The skill utilizes shell execution for ts-pack, jq, cat, and printf to process and analyze code structure.
  • Sanitization: There is no evidence of input validation or sanitization of the source code content before it is processed by the parser.
  • [EXTERNAL_DOWNLOADS]: The skill documentation notes that ts-pack downloads required language grammar libraries on first use. This is documented as the standard operational behavior of the tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 09:04 AM
Security Audit — agent-trust-hub — parsing-source