sca-osv-scanner
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the OSV-Scanner utility from Google's official GitHub repository using the Go installation command.
- [COMMAND_EXECUTION]: The skill uses shell commands to run the osv-scanner tool for analyzing project dependencies and saving the output to a JSON file.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external project files to identify vulnerabilities, which represents a potential surface for indirect prompt injection.
- Ingestion points: Project directories and lockfiles (SKILL.md).
- Boundary markers: None.
- Capability inventory: Execution of the osv-scanner CLI.
- Sanitization: No specific sanitization mentioned for external data.
Audit Metadata