health-check

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses the uvx tool to download and execute the latest version of the pyscn package from the Python Package Index (PyPI) at runtime.
  • [COMMAND_EXECUTION]: The skill executes shell commands to run the pyscn analysis tool on user-specified file paths.
  • [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by processing untrusted Python source code provided by the user. Maliciously crafted content within the analyzed files (such as comments) could be included in the tool's output report, which the agent is then instructed to read and interpret.
  • Ingestion points: Python source files located at the user-provided <path> referenced in SKILL.md.
  • Boundary markers: No specific delimiters or warnings are instructed for the agent when reading the generated report files in .pyscn/reports/.
  • Capability inventory: Subprocess shell execution via uvx as defined in the command table in SKILL.md.
  • Sanitization: There is no evidence of sanitization or filtering applied to the content of the analyzed files or the generated reports before they are processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 05:06 AM