dependency-vulnerability-audit
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to run specific security CLI tools such as
npm audit,pip-audit,govulncheck, andcargo audit. These commands are specific to the skill's purpose of identifying vulnerabilities in project dependencies. - [EXTERNAL_DOWNLOADS]: The skill guides the installation of well-known auditing tools from official package registries (PyPI, Go proxy, Crates.io, RubyGems). These are standard operations for setting up a security auditing environment.
- [PROMPT_INJECTION]: The skill processes project manifest files which are technically untrusted data sources. While this represents a surface for indirect prompt injection, the skill's operation is limited to auditing and reporting, and it lacks the high-privilege capabilities (such as network exfiltration or credential access) required to exploit such an injection.
Audit Metadata