sap-dependency-security
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust security posture for dependency management, including specific configurations for SAP-related development projects.
- [EXTERNAL_DOWNLOADS]: The skill references and integrates established third-party security tools (Socket, npq, sfw) and vendor-owned repositories (e.g., github.com/secondsky/*) for approved source pins, which are documented neutrally.
- [CREDENTIALS_UNSAFE]: The skill actively encourages moving away from plaintext secrets in environment files toward secure managers like 1Password CLI and Infisical, demonstrating a strong security focus.
- [COMMAND_EXECUTION]: The provided helper script 'generate-dependency-upgrades.sh' is a benign utility for project setup from local templates and does not perform any unauthorized or hidden operations.
- [SAFE]: The skill addresses the attack surface of processing manifest files by providing explicit boundary-enforcing tools and validation logic. 1. Ingestion points: package.json and lockfiles. 2. Boundary markers: Uses lockfile-lint and frozen installs. 3. Capability inventory: Local file generation via shell script. 4. Sanitization: Strict template usage.
Audit Metadata