security-audit
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a security audit workflow using well-known and trusted open-source tools.
- Automated Scanning: Instructions include running tools like Semgrep, Gitleaks, TruffleHog, and Trivy, all of which are standard in industry security workflows.
- Supply Chain Defense: The skill specifically warns against historical compromises (e.g., ua-parser-js, xz-utils, polyfill.io) and provides guidance on avoiding vulnerable versions of security tools themselves (e.g., specific compromised versions of Trivy).
- Agent-Specific Auditing: Includes a dedicated manual pass for AI-agent risks such as prompt injection (ASI01) and tool misuse (ASI02), following OWASP Top 10 for Agentic Applications.
- Data Privacy: The skill enforces local reporting within
docs/local/and explicitly requires verification that these files are gitignored to prevent accidental exposure of vulnerability data. - Least Privilege: Instructions consistently emphasize minimal permissions for containers and service accounts.
Audit Metadata