secure-code-guardian
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: CRITICALINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [METADATA_POISONING]: The documentation URL (https://jeffallan.github.io/claude-skills/skills/security/secure-code-guardian/) and the skill file (SKILL.md) were flagged by automated scanners. Analysis indicates these are likely false positives caused by the presence of standard attack strings (e.g., SQL injection and XSS payloads) used for educational purposes and validation checkpoints within the documentation. The domain is a well-known service (GitHub Pages) and represents a legitimate vendor resource consistent with the author's identity.
- [INDIRECT_PROMPT_INJECTION]: The skill provides guidance on processing user-provided code, which represents a potential attack surface for indirect instructions. 1. Ingestion points: User requests for code review or security implementation guidance processed in SKILL.md. 2. Boundary markers: The skill provides explicit 'MUST DO' and 'MUST NOT DO' constraints to guide the agent's behavior and minimize accidental obedience to embedded data. 3. Capability inventory: No executable tools, network operations, or file-writing capabilities are defined in the skill; it primarily generates code based on provided templates. 4. Sanitization: The skill is fundamentally centered on providing sanitization and validation best practices (e.g., Zod schema validation, DOMPurify for XSS prevention, and parameterized SQL queries).
- [SAFE]: All code examples provided, such as those for bcrypt password hashing, JWT token verification, parameterized queries, and Helmet security headers, represent industry-standard security practices. The skill explicitly forbids hardcoding secrets and mandates the use of environment variables and strong, modern encryption algorithms.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata