osv-scanner
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions involve executing the
osv-scannercommand-line tool to perform security audits on project files, including lockfiles and manifests. - [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the OSV-Scanner tool from Google's official GitHub repository (
github.com/google/osv-scanner). This is a legitimate download from a well-known and trusted source for security tooling. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from project lockfiles (e.g.,
package-lock.json,go.sum) and SBOM files. While these files are ingestion points for external data, the risk is mitigated as the data is used for vulnerability version matching by the scanner and is not interpolated into the agent's system prompt or executed as shell commands.
Audit Metadata