security-review
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves ingesting and analyzing untrusted codebase content, creating a surface for indirect prompt injection. A malicious codebase could include instructions in source files or comments to influence the agent's findings.\n
- Ingestion points: The skill reads source files, dependencies, and configuration files during scope resolution (Step 1), secret scanning (Step 3), and vulnerability deep scanning (Step 4).\n
- Boundary markers: There are no instructions defining boundaries for external data or commands to ignore instructions found within the scanned content.\n
- Capability inventory: The skill can read arbitrary files and generate code patches (Step 8), which could be leveraged if the agent is compromised by malicious input.\n
- Sanitization: No sanitization, validation, or escaping of the scanned code is defined in the workflow.\n- [SAFE]: Heuristic detections of eval/exec patterns in reference files are benign. These instances are part of descriptive vulnerability patterns for the agent to look for in target code and are not executable within the skill itself.
Audit Metadata