insecure-source-code-management
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill contains documentation and methodology for identifying version control metadata exposure (.git, .svn, .hg) and backup file leaks during authorized penetration testing assessments.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for ingesting untrusted data by instructing the agent to fetch files from targeted external web servers (e.g.,
/.git/config,/.env). - Ingestion points: Content fetched from target URLs specified in the probes (SKILL.md).
- Boundary markers: Absent; the skill does not specify delimiters for external content.
- Capability inventory: No executable scripts or subprocess calls are included in this skill; it relies on the agent's base capabilities and referenced external tools.
- Sanitization: Absent; the skill instructs the agent to process the recovered metadata directly.
Audit Metadata