dependency-scanning
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is designed to improve software supply chain security by identifying known vulnerabilities (CVEs) and ensuring license compliance using industry-standard tools and databases.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute standard security CLI tools, such as
npm audit,pip-audit, andTrivy, within the project environment to perform its analysis. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it reads and processes content from untrusted external dependency manifest files (e.g.,
package.json,requirements.txt). - Ingestion points: Manifest and lock files identified during the 'Detect Package Ecosystem' workflow step.
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified in the provided workflow.
- Capability inventory: The skill utilizes shell command execution (running audit tools) and file system writes (applying automated fixes/upgrades).
- Sanitization: The instructions do not describe any sanitization or validation of the contents of the manifest files before they are processed by the agent.
Audit Metadata