dependency-decision-helper
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is restricted to a read-only workflow. It explicitly prohibits file modifications, package installations, branch/PR creation, or state mutations within the Endor Labs platform.
- [SAFE]: The skill handles sensitive configuration files safely. It contains specific instructions to extract only the namespace key from the Endor configuration file (~/.endorctl/config.yaml) and strictly forbids echoing secrets, tokens, or credential keys.
- [SAFE]: To mitigate potential indirect prompt injection, the skill includes explicit instructions to treat all external inputs, such as repository files and command outputs, strictly as data rather than instructions.
- [SAFE]: Command execution is limited to specific, documented, read-only lookups using the vendor's official 'endorctl' CLI tool, with placeholders clearly defined for package coordinates.
Audit Metadata