israeli-appsec-scanner
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's content, metadata, and scripts are entirely aligned with its purpose as a security and compliance auditor. No malicious patterns, persistence mechanisms, or unauthorized data access behaviors were found.
- [OBFUSCATION]: The skill documentation in
references/owasp-hebrew-checklist.mdcontains homoglyph character examples (e.g., 'gооgle.com' using Cyrillic 'о') and mentions of BiDi control characters. These are explicitly provided as educational materials to help developers identify and prevent IDN homograph and BiDi attacks, and do not constitute a security threat. - [INDIRECT_PROMPT_INJECTION]: The skill provides Python and Bash scripts that process local file content to detect vulnerabilities. While this creates a data ingestion surface, the scripts are designed for local security auditing and lack exfiltration or unsafe dynamic execution capabilities.
- [EXTERNAL_DOWNLOADS]: Instructions within the skill refer to well-known security tools including Trivy, Snyk, and TruffleHog. All references point to established official domains and repositories, which is appropriate for a security-oriented tool.
Audit Metadata