reality-check
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to run grep for pattern matching across the codebase and git blame to check the age of TODO comments. These operations are standard for code auditing tasks and are used within the scope of the skill's stated purpose.- [PROMPT_INJECTION]: The skill processes untrusted code from user-defined paths, creating a surface where malicious instructions embedded in the analyzed code could potentially influence the agent's behavior (Indirect Prompt Injection). 1. Ingestion points: The agent uses Read, Grep, and Glob on files within the target path. 2. Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded prompts within the files being audited. 3. Capability inventory: The skill has access to Bash and file system tools. 4. Sanitization: No explicit sanitization or filtering of file content is mentioned.
Audit Metadata