security-scanning-security-dependencies
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The Python implementation in
resources/implementation-playbook.mdusessubprocess.runto invoke external security scanners. The commands are passed as lists (e.g.,['npm', 'audit', '--json']), which is a security best practice that prevents shell injection vulnerabilities. The behavior is consistent with the skill's primary purpose of security auditing. - [EXTERNAL_DOWNLOADS]: The documentation references and providing installation instructions for several third-party security utilities, including
safety,pip-audit,snyk,npm-check-updates,govulncheck, andcargo-audit. These are well-known, legitimate tools hosted on official package registries (PyPI, NPM, etc.). - [DATA_EXPOSURE]: The skill scans local dependency manifest files (like
package.jsonorrequirements.txt) to identify vulnerabilities. No evidence was found of sensitive data exfiltration or access to unauthorized file paths.
Audit Metadata