sast-configuration
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install standard security tools from official sources. This includes fetching the Semgrep package via pip and installing the CodeQL extension for the GitHub CLI.
- [COMMAND_EXECUTION]: The skill includes shell command examples for tool installation (
pip install), container management (docker run), and security scanning (semgrep,codeql). These are standard administrative commands for setting up a security testing environment. - [INDIRECT_PROMPT_INJECTION]: As a tool designed to analyze application code and configuration files, the skill inherently interacts with untrusted external data. While this presents a surface for indirect prompt injection, it is the primary intended function of a SAST configuration skill.
- Ingestion points: Analyzes application source code and custom rule definitions (YAML).
- Boundary markers: None explicitly defined in the provided snippets.
- Capability inventory: Includes capabilities for file system access and network communication (via the tools themselves) to report vulnerabilities.
- Sanitization: Not applicable, as the skill provides configuration logic for third-party security engines.
Audit Metadata