agent-implementer-sparc-coder
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFE
Full Analysis
- [Unverifiable Dependencies & Remote Code Execution] (SAFE): The skill does not download or execute remote scripts. It triggers local testing tools (
npm test,pytest) as part of its documented workflow. - [Data Exposure & Exfiltration] (SAFE): No sensitive file access (e.g., .ssh, .aws) or unauthorized network activity was identified.
- [Prompt Injection] (SAFE): The instructions do not contain markers intended to bypass safety filters or override agent behavior.
- [Command Execution] (SAFE): Shell hooks in the YAML metadata are limited to checking directory existence and running established test runners.
- [Indirect Prompt Injection] (SAFE): The agent processes external specifications which theoretically allow for indirect injection, but the risk is minimized by the skill's primary focus on generating code rather than making privileged decisions. 1. Ingestion points: Code specifications and designs referenced in the workflow. 2. Boundary markers: Absent. 3. Capability inventory: Local bash execution for testing purposes. 4. Sanitization: Absent.
Audit Metadata