vulnerability-scanner
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFENO_CODE
Full Analysis
- SAFE (SAFE): The content is purely educational and instructional, focusing on security best practices like Zero Trust, Least Privilege, and Threat Modeling. It does not contain any prompt injection or malicious commands.\n- NO_CODE (SAFE): The skill references a script at
scripts/security_scan.pyfor automated validation, but the file was not provided for analysis. The current assessment is limited to theSKILL.mdfile, which contains only markdown documentation.\n- PROMPT_INJECTION (SAFE): An indirect prompt injection surface exists because the tool is designed to ingest and scan untrusted codebases. This is an inherent risk for its intended primary purpose and is classified as safe here. \n - Ingestion points: The skill processes a
<project_path>via a validation script.\n - Boundary markers: No explicit delimiters or ignore-instructions warnings are provided in the documentation for the agent when reading target files.\n
- Capability inventory: Tools enabled include
Read,Glob,Grep, andBash.\n - Sanitization: No sanitization or validation of the ingested project content is mentioned in the methodology.
Audit Metadata