audit-dependencies
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute standard package management and audit tools (e.g.,
npm,pip,cargo,go,grep) to list dependencies and analyze the source tree. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from project manifest files and scanner outputs, which presents a surface for indirect prompt injection.
- Ingestion points: Reads project manifest files (
package.json,requirements.txt,pyproject.toml,Cargo.toml,go.mod,Gemfile) and the output from audit tools (npm audit,pip-audit,cargo audit). - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded content within the ingested files.
- Capability inventory: The skill performs file system reads (source code and manifests), command execution (package managers and audit tools), and file system writes (generating audit reports).
- Sanitization: The skill does not explicitly perform sanitization or schema validation on the manifest file content.
Audit Metadata