supply-chain-hardening
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill recommends using
sudoto upgrade the npm package manager to version 11 or higher (sudo npm i -g npm@latest) to support specific security configurations. This is presented as a prerequisite administrative task for enabling the hardening features. - [COMMAND_EXECUTION]: The workflow involves executing a local reference script (
scripts/hotpatch.example.sh) to perform heuristic scans. It also suggests manually inspecting and running package scripts usingjqandnpm run postinstallduring manual review processes. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an ingestion surface for untrusted data by scanning external package tarballs. To mitigate the risk of malicious payload execution during this phase, it recommends the use of sandboxing technologies such as
bwrap,firejail, orunshare. - [EXTERNAL_DOWNLOADS]: References and downloads resources from well-known and official sources, including the npm registry, OSV.dev (Open Source Vulnerabilities database), and StepSecurity.io for threat intelligence and vulnerability data.
Audit Metadata