skill-scanner
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFE
Full Analysis
- Data Exposure & Exfiltration (SAFE): The script reads metadata from local skill files; it does not access sensitive data or perform network exfiltration.
- Unverifiable Dependencies & Remote Code Execution (SAFE): No external dependencies are used. The script contains no dynamic code execution functions.
- Command Execution (SAFE): The script does not execute shell commands or subprocesses.
- Network Operations (SAFE): The skill lacks networking code.
- Indirect Prompt Injection (SAFE): The tool has no exploitable capabilities (write/exec) to act on data read from scanned files. Evidence Chain: (1) Ingestion: scripts/scan_skills.py. (2) Boundaries: None. (3) Capability: Read-only. (4) Sanitization: Truncates output.
Audit Metadata