skills/jeremylongshore/tons-of-skills-marketplace/windsurf-dependency-management/Gen Agent Trust Hub
windsurf-dependency-management
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from project files which could contain malicious instructions.
- Ingestion points: Dependency manifest files such as
package.json,requirements.txt, and configuration files like.npmrcas listed inreferences/directory-structure.md. - Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the processed files in
SKILL.mdorreferences/implementation.md. - Capability inventory: The skill is granted
Bash(cmd:*),Read,Write,Edit, andGrepcapabilities in the YAML frontmatter. - Sanitization: No evidence of sanitization, filtering, or validation of the external file content was found in the implementation guidelines.
- [COMMAND_EXECUTION]: The skill utilizes the
Bash(cmd:*)tool to run commands such asnpm audit. While this is the intended functionality for dependency management, it interacts directly with the data ingested from the project files.
Audit Metadata