dependency-management
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents standard shell commands for package managers including npm, pip, poetry, and bundler. These are provided as instructional references for common software development workflows.
- [EXTERNAL_DOWNLOADS]: The skill references and recommends several widely-used and reputable developer tools and security scanners such as Snyk, Safety, and Pip-audit. It also includes examples of resolving packages from the official npm registry.
- [INDIRECT_PROMPT_INJECTION]: The skill includes a shell script,
scripts/scaffold-tests.sh, which accepts a source file path as a command-line argument. This identifies a surface where the agent might interact with user-controlled filenames, although the current implementation is a placeholder that only performs echo operations.
Audit Metadata