cali-ops-package-audit
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install well-known security utilities (Socket, Trivy, OSV-Scanner, dotenvx) from official package registries (npm, pip) and system package managers (Homebrew). These are established security tools and their usage is consistent with the skill's primary purpose.
- [COMMAND_EXECUTION]: The skill provides concrete commands for local filesystem scanning, vulnerability identification, and environment variable encryption. All command execution is scoped to the security auditing workflow and requires user confirmation.
- [DATA_EXFILTRATION]: While the
socket scancommand may transmit package manifest data to Socket.dev for behavioral analysis, this is an expected function of the service. No unauthorized exfiltration of sensitive files or credentials was detected. - [PROMPT_INJECTION]: The instructions do not contain patterns designed to override agent safety constraints or bypass system guidelines.
- [CREDENTIALS_UNSAFE]: The skill specifically recommends using
dotenvxfor secret encryption and management, which is a defensive measure against hardcoded credentials and accidental exposure.
Audit Metadata