code-hardcode-audit
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The orchestrator script and its tool-specific wrappers execute several system analysis tools including ruff, semgrep, and gitleaks. These operations are performed using the subprocess.run method with list-based arguments, which effectively mitigates the risk of shell command injection through maliciously crafted file paths.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes npx to dynamically fetch and execute the jscpd package from the well-known NPM registry. This is used for its intended function of duplicate code detection.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it is designed to process and analyze untrusted source code provided by users.\n
- Ingestion points: Any source code files residing within the target directory path provided to the audit_hardcodes.py script.\n
- Boundary markers: The system lacks explicit boundary markers or instructions to the model to ignore embedded directives within the files being scanned.\n
- Capability inventory: The skill performs system command execution via subprocess.run calls across multiple scripts (audit_hardcodes.py, run_gitleaks.py, run_jscpd.py, run_ruff_plr.py, run_semgrep.py).\n
- Sanitization: The implementation uses safe subprocess execution patterns (list arguments) which prevent file paths from being interpreted as shell commands, though the tool outputs themselves are processed as data.
Audit Metadata