deps-audit
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches package metadata and source tarballs from the official Hex Elixir registry (hex.pm and repo.hex.pm) to perform its security analysis. These downloads target well-known, trusted package repositories as part of the tool's core functionality.
- [COMMAND_EXECUTION]: The skill invokes local development tools including
mix,git,perl, andpython3to resolve dependency differences, parse lock files, and perform static analysis on source code. - [SAFE]: Security alerts regarding homoglyphs and Unicode steganography originate exclusively from the
smoke-test/andfixtures.d/directories. These are verified as test data used to validate that the tool's detection heuristics are working correctly. - [SAFE]: The skill utilizes an ephemeral temporary directory (
AUDIT_TMPDIR) for analysis artifacts, which is automatically cleaned up upon completion. It maintains a strictly non-persistent and non-mutating workflow, with no sensitive data exfiltration detected.
Audit Metadata