secleak-check
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local system commands such as
git,betterleaks, andtrivy. These are used to analyze the repository for staged files, secrets, and vulnerabilities. The execution is confined to the target repository context. - [EXTERNAL_DOWNLOADS]: The skill provides GitHub Action templates in
references/guardrails.mdthat download thebetterleaksbinary from its official GitHub repository. The download process follows best practices by including an integrity check using a SHA-256 checksum to ensure the file has not been tampered with. - [PRIVILEGE_ESCALATION]: The provided CI/CD templates use
sudo installto move downloaded security binaries into system-wide execution paths. This is a standard and expected behavior for setting up environments in automated CI runners. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the target repository, including file paths and scanner results. It implements safety measures by explicitly instructing the agent to redact raw secrets from its responses and by using pre-defined regex patterns to identify sensitive paths, which mitigates the risk of malicious data in the repository influencing the agent's behavior.
Audit Metadata