sast-flawfinder
Warn
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (MEDIUM): The skill requires installing 'flawfinder' via pip, which is a third-party dependency installation.
- [COMMAND_EXECUTION] (LOW): The skill uses bash commands to execute the scanner on the local host.
- [INDIRECT_PROMPT_INJECTION] (MEDIUM): This skill processes untrusted external source code which can be used for indirect prompt injection.
- Ingestion points: Target source files and scan result JSON.
- Boundary markers: None; there are no delimiters to separate code from instructions.
- Capability inventory: File system access and local command execution.
- Sanitization: None; the agent parses the raw tool output.
Audit Metadata