debug-static-analysis
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute various security auditing tools via the shell, including npm audit, pip-audit, cargo audit, and others. These are legitimate and expected behaviors for a static analysis skill.
- [EXTERNAL_DOWNLOADS]: The skill utilizes npx to run audit-ci, which may involve a temporary download from the official npm registry. It also references standard Python security packages like pip-audit and safety. These resources originate from well-known services and trusted package registries.
- [SAFE]: Static analysis hints flagged eval and exec usage in references/insecure-defaults.md. Investigation confirms these are false positives; the keywords appear within a documentation table meant to educate users on insecure patterns to avoid, rather than as executable instructions for the agent.
- [SAFE]: The skill includes extensive regex patterns for detecting hardcoded secrets (AWS keys, GitHub tokens, etc.). These patterns are used for detection purposes within the user's codebase and are not used for malicious data collection.
Audit Metadata