security-audit-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a legitimate security auditing toolset. Its primary function is to guide users through security hardening and provide scripts to automate common checks.
- [COMMAND_EXECUTION]: The skill includes instructions to run local Python scripts (
scripts/scan_secrets.py,scripts/scan_iac.py,scripts/check_headers.py). These scripts are designed for local analysis of the user's project files and testing of remote server headers, which is expected behavior for a security tool. - [INDIRECT_PROMPT_INJECTION]: The automation scripts ingest external data, such as local source code files or remote HTTP headers. While this creates a theoretical surface for indirect injection if a user were to scan intentionally malicious content, the scripts' reliance on static regex patterns and their purely informative output format significantly limit the potential for agent manipulation. This is considered a characteristic of the tool's primary purpose.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The
scripts/check_headers.pyscript performs network operations usingurllib.requestto fetch headers from a user-specified URL. This is a standard and necessary function for a header validation tool and does not involve exfiltration of sensitive local data.
Audit Metadata