paniolo-scan
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch the @paniolo/cli package from the NPM registry. This is a recognized vendor resource consistent with the skill's stated purpose for auditing.
- [COMMAND_EXECUTION]: The skill executes the command 'npx --yes @paniolo/cli scan' to perform a deterministic audit. The execution is read-only and focused on generating a report for the user.
- [INDIRECT_PROMPT_INJECTION]: The skill processes output from the @paniolo/cli tool to summarize findings. While this involves ingesting external data into the agent's context, the risk is minimal because the skill lacks file-write, privilege escalation, or network exfiltration capabilities. Ingestion points: Output from npx CLI tool. Boundary markers: None specified. Capability inventory: Shell command execution (read-only), terminal output presentation. Sanitization: None specified.
Audit Metadata