fix-review
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill references source code and resources from Trail of Bits, a well-known security research firm.
- [PROMPT_INJECTION]: The skill instructions involve processing untrusted external data, which presents an indirect prompt injection surface.
- Ingestion points: The skill specifically targets the analysis of git commits and security audit findings within its instructions in
SKILL.md. - Boundary markers: No explicit markers or delimiters (such as XML tags or Markdown code blocks with headers) are required by the instructions to isolate untrusted content from the agent's logic.
- Capability inventory: The agent is instructed to analyze and validate source code and version control metadata.
- Sanitization: There are no instructions for sanitizing, escaping, or validating the integrity of the external data before it is processed by the agent.
Audit Metadata