secure-dependency-health-check
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requests the Bash tool, which is intended for standard development tasks such as project interaction, file searching, and the execution of the official Snyk CLI for authentication as described in the README.
- [EXTERNAL_DOWNLOADS]: The skill relies on the Snyk MCP server and official Snyk package health check tools. These are vendor-owned resources used to provide security metadata from Snyk's databases, representing safe and functional behavior for a security evaluation tool.
- [INDIRECT_PROMPT_INJECTION]: The skill ingest package names from user requests and metadata from the Snyk API. While this creates a surface for potential indirect prompt injection (e.g., malicious package names), the skill explicitly includes a security logic phase to detect and disqualify packages based on typosquatting, high-severity vulnerabilities, and malicious patterns. Ingestion points: User functional requirements and candidate names in SKILL.md Phase 1. Capability inventory: Bash, Read, Write, Grep. Sanitization: The skill includes logic to detect disqualifying traits in packages and verify their authenticity.
Audit Metadata