dependency-track
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides professional documentation, deployment manifests, and CI/CD integration scripts for Dependency-Track. All code examples and scripts utilize standard security practices, such as sourcing credentials from environment variables or secure vault integrations (e.g., Azure Key Vault). Any sensitive data handled by the scripts is limited to intended application logic for managing Software Composition Analysis platforms.
- [EXTERNAL_DOWNLOADS]: The instructions and CI/CD pipelines reference official release sites and repositories for Dependency-Track, CycloneDX, and Syft. These are well-known, reputable sources within the software security ecosystem. The skill downloads configurations and tools only from these project-authorized domains.
- [INDIRECT_PROMPT_INJECTION]: The skill includes functionality to ingest and process SBOM (Software Bill of Materials) data in JSON and XML formats. While this represents an ingestion point for external data, the processing capabilities are restricted to standard Software Composition Analysis (SCA) workflows, specifically encoding and uploading inventory data to a user-configured API endpoint for scanning.
Audit Metadata