license-scan-scancode
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
scancodecommand-line interface to analyze source code. It includes various execution patterns such as parallel processing (-n 4) and JSON output generation (--json-pp). - [INDIRECT_PROMPT_INJECTION]: The skill processes external codebase data, which serves as a surface for indirect prompt injection.
- Ingestion points: Source code files located at the
<target-path>specified inSKILL.md. - Boundary markers: No specific delimiters or safety instructions are defined to separate the tool's output from the agent's reasoning instructions.
- Capability inventory: The skill performs shell command execution using the
scancodeutility as defined inSKILL.md. - Sanitization: There is no explicit sanitization or escaping of the file content or license metadata detected by the tool before it is presented to the agent for summarization.
Audit Metadata