skills/reason-machines/security-skills/awesome-claude-code-security-compliance-suite/Gen Agent Trust Hub
awesome-claude-code-security-compliance-suite
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install code from an unverified GitHub repository not associated with the primary author context. Evidence: 'git clone https://github.com/sparkfinderoven/r01-hesreallyhim-awesome-claude-code-security.git' in SKILL.md.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted external data (source code, architecture files), which could contain malicious instructions targeting the AI agent. \n
- Ingestion points: File paths and directories passed to commands like /owasp-scan, /gdpr-audit, and /threat-model in SKILL.md. \n
- Boundary markers: Absent. The documentation shows no delimiters or 'ignore' instructions for the data being scanned. \n
- Capability inventory: Shell execution and filesystem access across all commands. \n
- Sanitization: Absent. No input validation or sanitization is mentioned for the processed code or files.\n- [COMMAND_EXECUTION]: The skill implements several commands that perform filesystem operations and execute external tools. Evidence: /owasp-scan, /dep-cve, /gdpr-audit, /soc2-readiness, /threat-model, /pentest-report, /secret-detect, /iam-audit, /incident-playbook, and /privacy-policy.\n- [DYNAMIC_EXECUTION]: The skill references the execution of a locally-hosted Python script as part of its pre-commit hook configuration. Evidence: 'python scripts/entropy-scan.py' in SKILL.md.
Audit Metadata