npm-supply-chain-check
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The unit tests in
tests/test_scan_npm_supply_chain.pyutilizesubprocess.run()to execute the local scanner script for verification purposes. This is standard testing behavior and does not pose a runtime risk to the agent's environment. - [DATA_EXFILTRATION]: While the skill reads local files to detect supply-chain indicators, it lacks any network-facing capabilities (e.g.,
curl,requests). The operating contract explicitly restricts the skill to read-only local operations. - [SAFE]: No obfuscation, prompt injection, or persistence mechanisms were detected. The tool's behavior is consistent with its stated purpose of providing an offline security audit.
Audit Metadata