radare2
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill implements an on-demand bootstrap system that downloads radare2 binaries from the official GitHub repository (radareorg/radare2) if they are not already installed on the system.
- [COMMAND_EXECUTION]: The skill executes local radare2 utilities (r2, rabin2, etc.) to analyze binaries. The provided scripts correctly use the
--argument separator to ensure user-supplied file paths are treated as targets rather than command flags, preventing command injection. - [DATA_EXPOSURE]: The skill is designed to extract metadata, strings, and header information from binary files. While this involves reading user-provided files, it is the intended and essential functionality of a reverse engineering tool.
- [PROMPT_INJECTION]: The skill has a potential surface for indirect prompt injection because it processes untrusted binary data (ingestion points:
$TargetPathinrecon.ps1andrecon.sh). Maliciously crafted strings or function names within a binary could attempt to influence agent behavior. However, this is a characteristic risk of analysis tools and is considered low impact within its intended use case.
Audit Metadata