codeguard-security-code
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted data, such as source code, configuration files (.env), and dependency lock files (package-lock.json, pom.xml). While this creates a surface for indirect prompt injection, the risk is mitigated by explicit instructions for read-only discovery, structured workflows, and prohibitions against echoing sensitive values.
- [COMMAND_EXECUTION]: The skill utilizes a suite of standard security command-line tools including Maven (dependency-check), npm/pnpm/yarn audit, pip-audit, cargo audit, and Trivy to perform vulnerability scanning. These operations are within the expected scope of a security auditing tool.
Audit Metadata