dependency-audit-weapon
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified in the skill files.
- [PROMPT_INJECTION]: Instructions are strictly procedural and do not contain attempts to override or bypass safety filters. Phrases like "ignore" are used in the context of security vulnerability triage (e.g., "never recommend ignoring a critical CVE").
- [DATA_EXFILTRATION]: There are no commands that exfiltrate sensitive data. Configuration examples use standard GitHub Actions secrets (e.g.,
${{ secrets.SNYK_TOKEN }}) which is the recommended practice for credential management. - [EXTERNAL_DOWNLOADS]: The skill references well-known and trusted technology services and organizations (GitHub, Snyk, socket.dev, Anchore). All GitHub Action references point to official or highly reputable repositories (e.g.,
actions/checkout,anchore/sbom-action,snyk/actions). - [COMMAND_EXECUTION]: Command examples (e.g.,
npm audit,snyk test,pip-audit) are standard developer tools used for security auditing. The shell script logic in templates (such as the SBOM sanity check) is benign and correctly scoped to the task.
Audit Metadata