deps-health-inline
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage temporary directories, run package manager scripts (
pnpm build,pnpm type-check), and perform Git version control operations. - [COMMAND_EXECUTION]: Commands for the Beads tracking system (
bd create,bd update) interpolate variables derived from external dependency audit reports, which could allow for command injection if malicious data is present in dependency metadata. - [EXTERNAL_DOWNLOADS]: The workflow uses the
pnpmpackage manager to update dependencies, which involves downloading code from the official npm registry. - [DATA_EXFILTRATION]: The skill performs network-enabled operations such as
git pushandbd syncto update remote repositories and synchronization state with the tracking system. - [PROMPT_INJECTION]: The skill processes untrusted data from dependency audit reports (e.g., package names and vulnerability descriptions) and interpolates them into its own command execution flow, representing an indirect prompt injection surface.
Audit Metadata