dep-auditor
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to analyze external, untrusted data such as dependency manifest files and pull request descriptions. This represents a potential attack surface where malicious content within those files could attempt to influence the agent's behavior during the audit.
- Ingestion points: Dependency files (package.json, requirements.txt, Cargo.toml) as described in the audit checklist in SKILL.md.
- Capability inventory: Suggests the use of shell-based audit tools like npm audit, cargo audit, and pip-audit.
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands in the analyzed data are provided.
- Sanitization: No specific validation or escaping mechanisms are mentioned for handling the external input data.
Audit Metadata