Gen Agent Trust Hub

This skill is designed for security reviews but contains a critical vulnerability to Indirect Prompt Injection. It explicitly instructs the agent to prioritize instructions found within untrusted project documentation or code comments over established security best practices. Because the skill has the capability to modify code and commit changes, an attacker could embed malicious instructions in a repository to force the agent to introduce vulnerabilities or bypass security controls during the 'Fixes' phase.

The provider classified the analyzed snapshot as HIGH risk. This result applies to the content available at audit time.