skills/mukul975/anthropic-cybersecurity-skills/detecting-supply-chain-attacks-in-ci-cd/Gen Agent Trust Hub
detecting-supply-chain-attacks-in-ci-cd
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill queries official registries (registry.npmjs.org and pypi.org) to check if private package names exist publicly. These are well-known services used for intended security audit functionality.
- [COMMAND_EXECUTION]: The skill analyzes local repository files but does not execute the commands or scripts it finds; it only identifies risky patterns via regular expressions.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of CI/CD configuration files. It uses safe parsing for YAML to prevent injection attacks.
Audit Metadata