supply-chain-risk-auditor
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary purpose is security auditing of third-party code. It follows the principle of least privilege by performing static analysis of dependency manifests (
package.json,pyproject.toml,go.mod) and lockfiles without executing or building the audited code. - [EXTERNAL_DOWNLOADS]: The
collect.pyscript queries established, trusted services including the npm registry (registry.npmjs.org), PyPI (pypi.org), the Go module proxy (proxy.golang.org), OSV (api.osv.dev), and GitHub's official API (api.github.com). These sources are used to retrieve metadata (advisories, maintainer counts, push dates) rather than executable code. - [COMMAND_EXECUTION]: The skill uses
subprocess.runto call the GitHub CLI (gh) andpip-audit. These calls are implemented with safety in mind; for example, thepip-auditcall uses the--no-depsand--disable-pipflags to specifically prevent the execution ofsetup.pyfiles or the downloading of external distributions during the audit process. - [OBFUSCATION]: The
render.pyscript contains sophisticated logic to sanitize third-party metadata before it is included in the Markdown report. This includes collapsing whitespace and escaping characters like pipes (|) and brackets ([) to prevent metadata from the audited project from forging Markdown structural elements or corrupting table layouts. - [DATA_EXFILTRATION]: There is no evidence of sensitive data exfiltration. The skill reads local manifest files and sends package names/versions to official vulnerability databases. It specifically avoids reading dependency source code or secrets.
Audit Metadata