osv-scanner
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the
osv-scannerbinary, Go package, and Docker image from Google's official GitHub repositories (github.com/google/osv-scanner) and container registries (ghcr.io/google/osv-scanner). These are recognized as trusted sources. - [COMMAND_EXECUTION]: Includes standard bash commands for installing and running the scanner, such as
chmod +xto make the binary executable andsudo mvto place it in the system path (/usr/local/bin/). These actions are part of the documented installation process for the tool. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and scan third-party manifest files (e.g.,
package-lock.json,requirements.txt, SBOMs) which are untrusted data sources. While this presents an indirect injection surface common to all security scanners, the tool is a specialized analysis utility and does not interpolate this data into agent prompts in a way that bypasses safety controls.
Audit Metadata