skills/mukul975/anthropic-cybersecurity-skills/verifying-build-provenance-with-slsa-sigstore/Gen Agent Trust Hub
verifying-build-provenance-with-slsa-sigstore
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents the installation of security tools cosign and slsa-verifier from their official repositories. Sigstore and SLSA are well-known security frameworks, and these downloads are required for the skill's purpose.
- [COMMAND_EXECUTION]: The Python script scripts/agent.py executes the verification tools using subprocess.run() with an argument list rather than a shell string. This is a secure implementation that prevents command injection.
- [PROMPT_INJECTION]: The skill processes external artifact metadata but incorporates cryptographic identity pinning (OIDC) to verify the source. This architecture limits the risk of processing malicious instructions embedded in untrusted artifact metadata.
Audit Metadata