vulnerability-scanning
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The provided Node.js and Python scripts use system calls (child_process.exec and subprocess.run) to invoke local security binaries such as npm audit, bandit, and safety for the purpose of identifying vulnerabilities.
- [DYNAMIC_EXECUTION]: The skill performs runtime execution of command-line auditing tools to generate security reports in JSON format.
- [EXTERNAL_DOWNLOADS]: The skill references trusted GitHub Actions from Aqua Security (Trivy) and Snyk for CI/CD integration, and utilizes npx to fetch and run the eslint-plugin-security tool from the official registry.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted local files (source code and configuration) to generate its reports; however, this behavior is inherent to its primary function as a scanner and no exploitable logic was found.
Audit Metadata