vulnerability-validation
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from
security-findings.jsonand.factory/threat-model.md. Because these files are generated from potentially attacker-influenced codebases or external scans, they present a surface for indirect prompt injection. \n - Ingestion points: Reading of findings and threat model files in the 'Load Context' step (SKILL.md). \n
- Boundary markers: The agent is guided by a rigid 9-step analytical framework (Reachability, Control Flow, etc.), which provides logical constraints, though no explicit technical delimiters or 'ignore' instructions for the data itself are defined. \n
- Capability inventory: The skill is restricted to reading local files and writing a JSON report (
validated-findings.json). It does not invoke shell commands, perform network operations, or interact with sensitive system APIs. \n - Sanitization: While the skill processes data as structured JSON, there is no evidence of filtering or sanitizing the content for instruction-like patterns before processing. \n- [EXTERNAL_DOWNLOADS]: The skill includes links to well-known security resources for reference. \n
- Evidence: References to the FIRST.org CVSS calculator and OWASP testing guides in the SKILL.md body. These are considered trusted/well-known services and are noted here neutrally.
Audit Metadata