ln-820-dependency-optimization-coordinator

Pass

Audited by Gen Agent Trust Hub on Apr 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches support files and runtime scripts from the author's official GitHub repository (github.com/levnikolaevich/claude-code-skills) when they are missing from the local environment. \n- [COMMAND_EXECUTION]: Executes shell commands including node for its internal runtime, npm audit for Node.js analysis, dotnet list package for .NET, and pip-audit for Python. \n- [EXTERNAL_DOWNLOADS]: Recommends the installation of the pip-audit package via pip to facilitate security scanning of Python dependencies. \n- [PROMPT_INJECTION]: The skill ingests untrusted project data through manifest files, representing an indirect prompt injection surface. Ingestion points: Project manifests like package.json, requirements.txt, and pyproject.toml identified in Phase 1. Boundary markers: None present in the instructions. Capability inventory: Shell command execution (node, npm, dotnet, pip-audit) and delegation to sub-skills. Sanitization: No explicit validation or escaping of manifest content is documented.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 26, 2026, 01:34 PM