security-audit
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a legitimate security auditing toolset. It follows professional development practices by modularizing tasks across specialized agents (e.g., orchestrator, secret-scanner, file-analyzer) and enforcing report structure through templates and validation rules.
- [DYNAMIC_EXECUTION]: The skill uses static templates to generate and execute local helper scripts in Bash and Python for repository parsing. These are used to resolve complex dependency paths and provide shared scanning utilities without external code dependencies.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code and manifest files from target repositories. It mitigates potential injection risks by utilizing structured data artifacts for communication between agents and limiting tool output length with pipe commands like 'head'.
- [EXTERNAL_DOWNLOADS]: The skill interacts with official Google and Firebase management APIs (firebaseappcheck.googleapis.com and identitytoolkit.googleapis.com) to verify project-level security settings like App Check enforcement and SMS region policies. These interactions are limited to well-known services and serve the primary goal of the security audit.
Audit Metadata