security-platform-secrets
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to run security scanners includinggitleaks,trufflehog, andtrivy. These commands are used to detect secrets in local files, git history, and container images following industry standard practices. - [EXTERNAL_DOWNLOADS]: References and tool sources point to well-known and trusted organizations including OWASP, GitHub, HashiCorp, Amazon, Google, Microsoft, Aqua Security, and Truffle Security.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the filesystem and git history (ingestion points). It mitigates potential injection risks by enforcing the
--redactflag on all scanning tools (sanitization), ensuring raw secret values are never ingested into the agent context or reported in plain text (boundary markers). The skill is limited to standard file operations and bash execution (capability inventory). - [CREDENTIALS_UNSAFE]: The skill implements proactive secret protection by defining strict
sensitive_data_rulesthat forbid reading credential-related file patterns (e.g.,.env,.key,.pem) and forbid writing actual secret values to any output.
Audit Metadata