express-intent-in-code
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of code snippets or files which serves as an ingestion point for potential malicious instructions.
- Ingestion points: User-supplied code provided to the agent for refactoring (SKILL.md).
- Boundary markers: The instructions lack specific delimiters or directions to disregard embedded instructions (e.g., in comments or string literals) within the code being processed.
- Capability inventory: The skill has the capability to write files (verified edits) and execute shell commands (running lint and behavior checks).
- Sanitization: There is no mention of sanitizing or validating the input code before the agent processes it or executes associated test suites.
- [COMMAND_EXECUTION]: The skill instructions require the agent to execute shell-based verification tools and scripts found within the local environment.
- Evidence: "After verified edits, run fresh lint and the supplied behavior checks..." (SKILL.md).
- Risk: The skill relies on "supplied behavior checks," which are arbitrary scripts or executables. Executing these tools poses a risk if the repository containing the code and tests is untrusted or contains malicious scripts.
Audit Metadata