secure-development-lifecycle
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists entirely of instructional documentation and checklists for secure software development. It does not contain executable scripts, automated commands, or logic that processes external data.
- [DATA_EXPOSURE_EXFILTRATION]: No sensitive file paths, credential harvesting, or network exfiltration patterns were found. Code examples correctly demonstrate the use of parameterized queries and input validation to prevent common vulnerabilities like SQL injection.
- [PROMPT_INJECTION]: The instructions are clear and focused on developer guidance. There are no attempts to override agent behavior, bypass safety filters, or extract system prompts.
- [REMOTE_CODE_EXECUTION]: The skill mentions common security tools like CodeQL, SonarCloud, and OWASP Dependency Check in a conceptual CI/CD context. There are no executable shell commands or patterns that download and run untrusted code from the internet.
- [EXTERNAL_DOWNLOADS]: References to external documentation (OWASP, NIST, ISO) and the vendor's own security policy repository (Hack23) are appropriate for the skill's purpose and target well-known or author-affiliated domains.
Audit Metadata