security-check
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and installs the OpenSSF Scorecard utility from its official repository using
go install sigs.k8s.io/scorecard/v4@latest. This is a well-known security tool used to evaluate repository security posture. - [COMMAND_EXECUTION]: Executes shell commands to inspect and parse repository configuration files including
package.json,Gemfile,requirements.txt, andcrew.yml. These operations usecat,grep,awk, andpython3 -cfor localized data extraction and classification. - [PROMPT_INJECTION]: The skill processes untrusted data from repository manifests to classify security exploitability. While this presents an indirect prompt injection surface, it is consistent with the skill's primary purpose of security triage.
- Ingestion points:
package.json,Gemfile,requirements.txt,crew.ymlin the local repository - Boundary markers: None implemented
- Capability inventory: Shell command execution, Go package installation, and Python script execution
- Sanitization: None; file contents are processed directly via standard shell pipes
Audit Metadata