dependency-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust security layer through specific policy modules (BF-SECURITY-1 and BF-UNTRUSTED-1) that instruct the agent to treat repository artifacts as untrusted evidence and ignore any embedded prompt injection attempts.
- [SAFE]: Command execution is strictly limited by the BF-COMMAND-1 policy, which prohibits the execution of unknown scripts, privilege changes, or the passing of environment secrets to untrusted code.
- [SAFE]: The included Python script (scripts/validate_scenarios.py) is a static validation utility that only performs local text matching within the skill package to ensure documentation compliance; it contains no network or dangerous system calls.
- [SAFE]: The workflow integration (shared/workflow-contract.md) follows a secure, opt-in protocol for sharing leads between skills, emphasizing verification of all inherited claims against repository evidence.
Audit Metadata