dependency-lockfile-audit
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is entirely focused on security best practices and supply chain defense. It provides educational content on attack vectors like typosquatting and dependency confusion.
- [EXTERNAL_DOWNLOADS]: The provided bash script fetches package metadata and download statistics from well-known services (registry.npmjs.org and api.npmjs.org) for the purpose of identifying low-download or missing packages. These operations are informative and do not execute remote code.
- [COMMAND_EXECUTION]: The skill documents standard security commands for package managers (npm, pip, composer). These commands are intended to be run by a developer to audit their own environment and do not involve unsafe user-input interpolation.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes dependency names from a package.json file, it does not interpolate this data into agent instructions or execute it as code; it purely performs metadata lookups via API calls.
Audit Metadata