conan-vcpkg
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the vcpkg tool directly from the official Microsoft GitHub repository (https://github.com/microsoft/vcpkg.git). This is a well-known and trusted source for C++ development utilities.
- [COMMAND_EXECUTION]: The skill includes commands for tool initialization and package management, such as running the vcpkg bootstrap scripts (bootstrap-vcpkg.sh/bat) and using standard managers like pip to install Conan. These commands are necessary for the primary purpose of C++ package management.
- [INDIRECT_PROMPT_INJECTION]: The skill describes how to process C++ project manifest files such as vcpkg.json and conanfile.txt. While these files are ingestion points for external data, the workflow involves standard library declaration and resolution. 1. Ingestion points: Project manifest and configuration files (vcpkg.json, conanfile.txt, conanfile.py). 2. Boundary markers: None explicitly documented in the usage snippets. 3. Capability inventory: Includes cloning repositories, executing build scripts, and running package manager CLI tools. 4. Sanitization: Relies on the internal validation mechanisms of vcpkg and Conan.
Audit Metadata