python-pip-audit
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Recommends installing the
pip-auditpackage from PyPI and using the officialpypa/gh-action-pip-auditGitHub Action. These are trusted sources from the Python Packaging Authority (PyPA). - [COMMAND_EXECUTION]: Provides standard CLI commands for auditing dependencies (
pip-audit -r requirements.txt), fixing vulnerabilities (--fix), and generating SBOMs. These are the primary intended functions of the tool. - [INDIRECT_PROMPT_INJECTION]: The skill includes a 'Security Warning' regarding auditing untrusted requirements files, correctly identifying that dependency resolution involves downloading packages. This demonstrates a proactive security posture.
- [SAFE]: All external URLs (GitHub, PyPI, OSV) are well-known, trusted services. No malicious patterns, obfuscation, or unauthorized data access were detected.
Audit Metadata