grepai-init
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes a tool that indexes project files for vector search. This creates an attack surface where malicious content within the files being indexed could influence an AI agent's responses when it queries the index.
- Ingestion points: Files within the project directory where the tool is initialized (SKILL.md).
- Boundary markers: None specified in the documentation to distinguish between code and potential embedded instructions.
- Capability inventory: The tool performs file indexing (
grepai watch) and creates symbol indexes (index.gob,symbols.gob). - Sanitization: No sanitization, validation, or filtering of the content being indexed is mentioned.
Audit Metadata