dependency-scanning
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of the Dependabot CLI binary directly from GitHub's official releases. This is a legitimate operation for the skill's stated purpose.
- [COMMAND_EXECUTION]: Uses shell commands to identify project dependency files (such as package.json, requirements.txt, and go.mod), extract repository metadata from git remotes, and run the Dependabot CLI for graph analysis.
- [REMOTE_CODE_EXECUTION]: Provides instructions to install the Dependabot CLI using 'go install' or by downloading and executing a prebuilt binary from GitHub. These actions are intended for tool setup and originate from trusted sources.
- [PROMPT_INJECTION]: As a security scanning tool, it ingests untrusted data from repository manifest files and lockfiles. While this presents a surface for indirect prompt injection, the skill mitigates risk by using structured tool calls and focused parsing logic.
Audit Metadata