Supply Chain Security
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a purpose-built security auditing tool with transparent logic.
- [EXTERNAL_DOWNLOADS]: The skill installs standard Python packages
pyyamlandrequestsfor manifest parsing and registry lookups. - [REMOTE_CODE_EXECUTION]: While the skill contains logic to detect remote code execution (e.g., checking for
curl | bashpatterns in dependency scripts), it does not perform any suspicious remote execution itself. - [DATA_EXFILTRATION]: The
supply_chain_auditor.pyscript performs network requests to official registries (npmjs.org, pypi.org, crates.io) to verify package existence. These are legitimate, documented operations for a supply chain auditor. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data (project manifest files and CI/CD configurations) for analysis. It uses dedicated scripts for parsing and applies heuristic checks rather than direct prompt interpolation, minimizing risks associated with indirect injection.
Audit Metadata