dependency-scanning
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Fetches and executes an installation script for the Syft SBOM generator from Anchore's public GitHub repository.\n- [EXTERNAL_DOWNLOADS]: Downloads the OWASP Dependency-Check release archive from its official GitHub repository.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing external project manifests (e.g.,
package.json,requirements.txt), which constitutes a potential surface for indirect prompt injection from untrusted data.\n - Ingestion points: Package manifest files (SKILL.md)\n
- Boundary markers: None specified in the documentation examples.\n
- Capability inventory: Shell command execution for running scanners, file system access for reading project files and writing reports.\n
- Sanitization: Not applicable to the provided documentation templates.
Audit Metadata