rust-dependency-audit
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install several well-known Rust CLI tools, including cargo-audit, cargo-deny, cargo-vet, and cargo-geiger, from the official crates.io registry. These are standard tools for security and compliance audits.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute cargo commands and shell scripts for tool installation and performing audits on local codebases.
- [INDIRECT_PROMPT_INJECTION]: The skill fetches data from external sources including the crates.io API and the Firecrawl scraping service to verify crate information.
- Ingestion points: Data fetched via WebFetch and Firecrawl curl commands (SKILL.md) is read directly into the agent context.
- Boundary markers: The instructions do not specify any delimiters or warnings to treat the fetched data as untrusted or to ignore embedded instructions.
- Capability inventory: The agent has access to the Bash tool to execute further cargo commands and the WebFetch/WebSearch tools.
- Sanitization: No sanitization or filtering is performed on the scraped content before it is processed by the agent.
Audit Metadata