helm-chart-security
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to install Helm plugins from external, community-managed GitHub repositories:
https://github.com/SecKatie/helm-vendor-pluginandhttps://github.com/jkroepke/helm-secrets. These sources are not associated with verified vendors or official organizations. - [COMMAND_EXECUTION]: The instructions include various shell commands for the agent to execute, such as
helm plugin install,helm verify, and runningcheckov. These involve the execution of external binaries and scripts downloaded at runtime. - [PROMPT_INJECTION]: As the skill is designed to audit and review external Helm charts and
values.yamlfiles, it presents an indirect prompt injection surface. It lacks boundary markers or explicit sanitization instructions to handle potentially malicious content embedded within the charts it processes. - Ingestion points: Helm charts,
values.yaml, andChart.yamlfiles (SKILL.md). - Boundary markers: Absent.
- Capability inventory: File system access, shell execution (
helm,checkov), and network access (plugin installation). - Sanitization: Absent.
Audit Metadata