production-audit
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs an automated version check by querying the vendor's domain
foundry.thehorizonfoundry.com. It also retrieves a JSON schema for report validation from the vendor's official GitHub repository atgithub.com/horizon-foundry/foundry. - [COMMAND_EXECUTION]: The skill utilizes several standard command-line tools for its auditing phases, including dependency auditors (
npm audit), secret scanners (gitleaks,trufflehog), and a JSON validator (ajv-cli). - [INDIRECT_PROMPT_INJECTION]: The skill implements a security best practice by explicitly instructing its dimension subagents to ignore any instructions encountered within the audited codebase, treating the code strictly as the subject of review.
- [DATA_EXPOSURE]: The skill manages a local configuration file at
~/.claude/foundry.jsonto store an owner email for report attribution. This is a local-only configuration mechanism for identifying report ownership.
Audit Metadata