keel-vendor
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements standard vendor management procedures including auditing local documentation and applying scorecard frameworks. Its operations are consistent with its stated purpose.
- [COMMAND_EXECUTION]: Employs basic shell commands (
findandgrep) to locate vendor-related files within the project repository. These commands are used for discovery and do not involve privileged execution or external data piping. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface due to its ingestion of untrusted data from local files.
- Ingestion points: Reads content from
.md,.csv, and.jsonfiles found in the local environment during the Step 1 audit. - Boundary markers: None; file content is analyzed directly without clear delimiters to isolate potential instructions within the data.
- Capability inventory: Includes the ability to execute shell commands (
Bash) and access external websites (WebFetch,WebSearch). - Sanitization: No content sanitization or validation logic is specified for the data read from project files.
Audit Metadata