dependency-vuln-report
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
npm auditand anodeone-liner to extract vulnerability data and version information from the project's lockfile. These are standard operations for a dependency auditing tool. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data (vulnerability advisories) which could theoretically contain instructions designed to influence the agent's report output.
- Ingestion points: Reads
/tmp/audit-prod.jsonand./package-lock.jsonvia the shell commands defined inSKILL.md. - Boundary markers: No explicit delimiters are used to separate the audit data from the agent's instructions.
- Capability inventory: The skill uses shell execution (
npm,node) and file system reads to perform its task. - Sanitization: No escaping or validation is performed on the data returned by the audit tools before it is processed by the agent.
Audit Metadata