dependency-vulnerability-triage
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements standard security practices for managing dependency vulnerabilities and no malicious intent or suspicious code patterns were detected.
- [COMMAND_EXECUTION]: The skill invokes common development tools such as
npm audit,npm test, andgitto perform its tasks. These operations are conducted locally and are necessary for the tool's stated purpose of vulnerability management. Evidence:execSyncusage inscripts/parse-audit.tsand shell commands inscripts/apply-patches.sh. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources (npm audit reports) to generate patch plans. While this represents an ingestion of untrusted data, the risk is inherent to the intended use case and the skill uses standard parsing methods. Ingestion points:
scripts/parse-audit.ts. Capability inventory:npm audit fix,git commit. Sanitization: Standard JSON parsing andjqutility usage.
Audit Metadata