security-scanning
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill consists of informational markdown files and metadata.
- [COMMAND_EXECUTION]: The skill contains conceptual examples of shell commands and GitHub Actions workflows (e.g., in
references/ci-workflows.md). These are placeholders (e.g.,echo "run SAST here") used for educational purposes and do not execute real commands or download external scripts. - [DATA_EXFILTRATION]: No patterns of data exfiltration were found. The skill provides guidance on preventing sensitive data exposure, such as loading secrets from environment variables and avoiding the logging of credentials.
- [PROMPT_INJECTION]: No prompt injection attempts were found. The skill contains 'Incorrect' code examples (e.g., SQL injection, command injection) in
references/common-findings-and-fixes.md, but these are explicitly labeled as negative patterns to avoid and do not attempt to override agent behavior. - [REMOTE_CODE_EXECUTION]: No remote code execution patterns or unverified dependencies were detected. The skill references well-known security tools (e.g.,
gitleaks,semgrep,trivy) as recommendations for users to implement in their own environments.
Audit Metadata