snyk-fix
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands to perform essential remediation tasks, including Git operations (branching, staging, committing, pushing), GitHub CLI interactions for PR creation, and package manager commands (e.g.,
npm install,pip install) to update dependency lockfiles. These operations are core to the skill's purpose. - [EXTERNAL_DOWNLOADS]: As part of the Software Composition Analysis (SCA) remediation process, the skill triggers package managers which may fetch updated dependencies or metadata from official public registries. This is expected behavior for resolving vulnerable packages.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it processes output from external scan tools (Snyk Code/SCA). While instructions could theoretically be embedded in scan results or manifests, the skill implements multi-step validation and mandates explicit user confirmation before committing changes or creating PRs.
- [DATA_EXFILTRATION]: Network activity is restricted to authenticated Git and GitHub operations intended for publishing security fixes. No patterns suggesting unauthorized exfiltration of sensitive files or credentials were found.
Audit Metadata