aeon-vuln-scanner
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes legitimate and well-known security scanning utilities (Semgrep, TruffleHog, osv-scanner, and Slither) for repository auditing, which is consistent with its stated purpose.
- [DATA_EXFILTRATION]: Data transmission via the GitHub API (
gh api) is restricted to submitting Private Vulnerability Reports (PVR), which is the intended and authorized behavior for responsible disclosure. - [PROMPT_INJECTION]: The skill analyzes untrusted code from external repositories to triage findings, which presents a surface for indirect prompt injection.
- Ingestion points: Snippets of code (30-50 lines) read from files within target repositories during the triage phase (SKILL.md).
- Boundary markers: No specific delimiters or markers are defined to isolate audited code from the agent's internal instructions.
- Capability inventory: The skill utilizes shell execution for running scanners and the GitHub CLI for reporting vulnerabilities (SKILL.md).
- Sanitization: There are no explicit validation or sanitization steps mentioned for the code snippets ingested during analysis.
Audit Metadata