dependency-sbom-osv
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from project manifest and lockfiles to generate vulnerability queries.
- Ingestion points: Project manifest and lockfiles (e.g., package-lock.json, requirements.txt, go.mod) as described in the ecosystem mapping table in SKILL.md.
- Boundary markers: The instructions do not define specific boundary markers for the agent to use when parsing these files, though it assumes standard structure parsing.
- Capability inventory: The skill facilitates file system read operations for dependency manifests and network operations (POST/GET) targeting the OSV API.
- Sanitization: The skill provides instructions for name normalization (e.g., PEP 503 for Python) and property resolution, which mitigates simple schema confusion.
- [NO_CODE]: The skill consists entirely of markdown instructions and YAML metadata; it does not contain any scripts, source code, or binary files that could be executed at runtime.
Audit Metadata