osv-scanner
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous examples of
osv-scannerCLI commands. These are legitimate uses of the tool for scanning local source code, lockfiles (package-lock.json, requirements.txt, etc.), and container images. - [EXTERNAL_DOWNLOADS]: The skill references Google's official GitHub Actions (
google/osv-scanner-action) and the OSV.dev database. These are trusted, well-known services and organizations provided by Google for security scanning. - [SAFE]: The instructions for managing
osv-scanner.tomland ignoring specific vulnerabilities are standard security practices for managing false positives in professional development environments. - [DATA_EXPOSURE]: While the scanner interacts with local files, it does so to read dependency manifests (lockfiles) for vulnerability analysis. The network operations described (
--download-offline-databases) are for fetching vulnerability data from Google's servers, not for exfiltrating sensitive local information.
Audit Metadata