audit-prep-assistant
Verdict safe, but 1 finding (1 medium), mainly command injection. Most recent scan 2026-02-06.
The audit-prep-assistant skill is a legitimate security preparation tool with LOW to MEDIUM risk. It provides valuable guidance for preparing codebases for security audits following Trail of Bits' methodology. The primary concern is command injection risk from executing static analysis tools without proper input validation (MEDIUM severity). The skill lacks the optional 'allowed-tools' declaration (LOW severity informational issue) and could benefit from resource limit guidance to prevent exhaustion (LOW severity). Missing referenced files appear to be false positives but should be clarified. No data exfiltration, credential theft, prompt injection, or malicious behavior detected. The skill operates locally and does not make network calls or access sensitive files. Overall, this is a useful development tool that would benefit from enhanced input validation and clearer documentation of its tool requirements.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).
- Package
- 1 file, 9.5 KB
- SKILL.md
- 1394 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Audit Prep Assistant · Purpose · The Preparation Process · Step 1: Set Review Goals · Step 2: Resolve Easy Issues · CodeQL and Semgrep checks · Step 3: Ensure Code Accessibility · Step 4: Generate Documentation · How I Work · Rationalizations (Do Not Skip) · Example Output · REVIEW GOALS DOCUMENT
Findings
MEDIUM Command Injection Risk in Static Analysis Tool Execution Command Injectionllm
The skill instructs the agent to execute multiple static analysis tools (slither, dylint, golangci-lint, CodeQL, Semgrep) via bash commands without proper input validation or sandboxing. If user input influences the command construction (e.g., project paths, file names), this could lead to command injection vulnerabilities where malicious input executes arbitrary commands.
SKILL.md
```bash
slither . --exclude-dependencies
dylint --all
golangci-lint run
```What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 9.5 KB |
External hosts referenced
github.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit a50696e20581. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/trailofbits/skills
- Raw scan result: plugins-building-secure-contracts-skills-audit-prep-assistant-scan.json
- Badge for your README:
- Request a re-scan