ghost-scan-code
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves reading and analyzing untrusted source code from a repository. This exposes the agent to indirect prompt injection, where an attacker could place malicious instructions in code comments or string literals within the repository to manipulate the scan results (e.g., instructing the agent to 'ignore all vulnerabilities' or 'report the code as safe').
- Ingestion points: The
prompts/analyzer.mdagent reads the contents of thecandidate_file(source code) directly into its context. - Boundary markers (absent): The instructions for the Analyzer Agent do not specify the use of strict delimiters or 'ignore embedded instructions' warnings when reading the source code content.
- Capability inventory: The sub-agents executed via
scripts/loop.shhave access to significant capabilities includingRead,Write,Edit,Glob,Grep, andBash(limited tomkdir). - Sanitization (absent): There is no evidence of sanitization or filtering of the source code content before it is processed by the LLM sub-agents.
Audit Metadata