dependency-health-loop
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute ecosystem-specific commands such as
npm audit,pip-audit, andcargo update. These commands are used to interact with official package registries to identify and resolve security vulnerabilities and outdated dependencies. - [DYNAMIC_EXECUTION]: The skill dynamically generates shell commands to install specific package versions derived from audit tool outputs (e.g.,
npm install <pkg>@<ver>). This behavior is restricted by policies that only allow autonomous updates for minor and patch versions, while requiring human intervention for major version changes. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from dependency manifests and audit reports provided by remote registries. Although this creates an ingestion point for potentially untrusted data, the risk is mitigated by the skill's use of structured data formats (JSON) and a robust human-in-the-loop (HITL) policy that pauses execution for any non-standard or breaking changes.
Audit Metadata