static-code-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: References several well-known and trusted GitHub repositories for pre-commit hooks, including projects from 'psf', 'PyCQA', and 'trufflesecurity'. These are well-known services in the developer ecosystem and are used for standard linting and security scanning tasks.
- [COMMAND_EXECUTION]: Includes a utility script and a TypeScript template that execute shell commands. Specifically, it uses 'child_process.exec' to run 'npm audit --json' for dependency vulnerability scanning. This is a standard operation for a security-focused developer tool.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and analyze external codebases. This creates an indirect prompt injection surface where malicious instructions could be embedded in code comments or string literals within the analyzed files to potentially influence the agent's behavior.
Audit Metadata