moai-security-devsecops
Pass
Audited by Gen Agent Trust Hub on Mar 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the SonarScanner CLI directly from SonarSource's official distribution server to facilitate automated quality gate checks during the build process.\n- [EXTERNAL_DOWNLOADS]: Reference documentation includes instructions for fetching GitHub Actions workflow templates from the MoAI Framework repository, which contains the skill's supplemental automation logic.\n- [COMMAND_EXECUTION]: The skill orchestrates multiple security CLI tools (Snyk, Trivy, and SonarScanner) using shell scripts and Python's subprocess module to perform vulnerability scanning on codebases and container images.\n- [DATA_EXFILTRATION]: Automated scripts transmit vulnerability scan results and status queries to external security management platforms, including SonarQube, Jira, and Snyk, using standard API authentication patterns.
Audit Metadata