ci-security
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
gosecsecurity scanner from its official GitHub repository using the commandgo install github.com/securego/gosec/v2/cmd/gosec@latest. - [COMMAND_EXECUTION]: The skill requires local command execution to build and test its Go components (
go test ./... && go build). - [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves scanning external, potentially untrusted file content (YAML workflows and Dockerfiles), which is an inherent injection surface.
- Ingestion points: File content passed as arguments to the
scan_workflowandscan_dockerfilefunctions mentioned inSKILL.md. - Boundary markers: No specific delimiters or instructions to ignore instructions embedded within the scanned files are provided.
- Capability inventory: The skill utilizes
go buildandgo testand executes the resultingci-securitybinary. - Sanitization: The instructions do not define specific input validation or escaping mechanisms for the content being audited.
Audit Metadata