skills/mukul975/anthropic-cybersecurity-skills/implementing-code-signing-for-artifacts/Gen Agent Trust Hub
implementing-code-signing-for-artifacts
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements artifact signing using established tools and secure coding practices. No malicious patterns or security vulnerabilities were detected.
- [COMMAND_EXECUTION]: Technical analysis of the Python scripts confirms that external tools (GPG, Cosign) are invoked using argument lists with
subprocess.run. This implementation detail correctly mitigates the risk of command injection from maliciously crafted filenames or inputs. - [EXTERNAL_DOWNLOADS]: The skill references reputable external resources and tools, such as the
cryptographylibrary and Sigstore's GitHub Actions. These are standard dependencies for the cybersecurity tasks described and originate from trusted sources.
Audit Metadata