audit-dependencies
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from audit reports and external changelogs during the vulnerability research phase.
- Ingestion points: Processes JSON output from
pnpm auditand content from external web searches (changelogs, release notes, and GitHub Security Advisories). - Boundary markers: None explicitly mentioned; the agent is instructed to parse and analyze the content directly.
- Capability inventory: The agent has the ability to write to
package.json, executepnpm install(which may run lifecycle scripts), and create pull requests viagh pr create. - Sanitization: No specific sanitization or validation of the ingested external content is described.
- [COMMAND_EXECUTION]: The skill executes local scripts (
./.github/workflows/audit-dependencies.sh) and standard developer tools (pnpm,gh). These operations are consistent with the skill's primary purpose of dependency management for thepayloadcmsproject.
Audit Metadata