dependency-audit
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from project dependency manifest files (e.g., package.json, requirements.txt, Cargo.toml) and lockfiles to perform its analysis.
- Ingestion points: Project configuration and lock files are read from the file system to build a dependency tree for auditing (referenced in SKILL.md).
- Boundary markers: The skill produces structured markdown reports which helps delineate data from instructions, although it lacks explicit delimiters to prevent the LLM from following natural language instructions embedded in package metadata.
- Capability inventory: The skill executes standard auditing and analysis tools such as npm audit, pip-audit, and cargo audit.
- Sanitization: Analysis is performed using established security tools, and the skill provides comprehensive logic to identify and flag suspicious patterns within the dependencies themselves.
Audit Metadata