sca-runner
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation in SKILL.md provides installation instructions for Trivy using a shell script from Aqua Security's official GitHub repository (https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh). This is a standard installation method for a well-known security tool and the source is a recognized provider.
- [COMMAND_EXECUTION]: The skill executes the 'npm' and 'trivy' commands locally using the Node.js 'child_process' module. The implementation uses 'spawn' and 'spawnSync' with argument arrays, which is a secure practice that prevents shell injection vulnerabilities. It does not automatically run installation scripts; it only invokes the tools if they are already present on the system.
- [DATA_EXFILTRATION]: No evidence of data exfiltration was found. The skill processes project dependency data locally and outputs the results to the standard output. There are no network requests to unknown or suspicious domains.
- [SAFE]: The skill functions as a legitimate security utility. It correctly identifies local project paths and interfaces with established security scanners to provide vulnerability data to the user.
Audit Metadata