plan-security-audit
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the agent to search for sensitive credentials such as 'service_role' keys, API keys, and '.env' files. However, it implements a strict 'Preservation Contract' that explicitly forbids the agent from echoing the actual secret values in the output, requiring only the file location and type to be reported.
- [COMMAND_EXECUTION]: The skill utilizes search patterns (regex/grep) and external tools (MCP, Firecrawl, npm audit) to identify vulnerabilities. These are standard operations for a security auditing tool and are gated by instructions prohibiting live exploit testing.
- [SAFE]: The skill is designed for 'plan only' activities, meaning it does not modify code or perform destructive testing on the target system. The instructions include specific methodology to prevent fabrication of CVEs and ensure research-backed findings.
Audit Metadata