dependencies-audit

github.com/cognitedata/builder-skills
Verdict: Proceed with caution
0 critical0 high7 medium
C
SCORE 55 / 100
$skillox install dependencies-auditSoon
Sign in to followFollowing emails you when a re-scan drops the grade. Opt-out is per-creator on /account/billing.

Why grade C?

score · 55 / 100

The current grade reflects 7 medium findings (6+ MEDs → C).

0 CRIT0 HIGH7 MED0 LOW
To reach a higher grade
  • B
    Reach Btarget score 75

    Resolve 2 of 7 MED (cap is 5).

  • A
    Reach Atarget score 95

    Resolve 5 of 7 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Latest scan findings

Scan crawl-zeirfwv1gf6gfpvwko53994x · Thu, 28 May 2026 17:53:42 GMT · 18ms

med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 63CWE-78
▾
61```bash
62node -e "
63 const { execSync } = require('child_process');← spawns a subprocess outside declared capabilities
64 const pkg = require('./package.json');
65 const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 69CWE-78
▾
67 for (const [name, usedVersion] of Object.entries(allDeps)) {
68 try {
69 const info = JSON.parse(execSync('npm view ' + name + ' --json 2>/dev/null', { encoding: 'utf8' }));← spawns a subprocess outside declared capabilities
70 const latest = info['dist-tags']?.latest || 'unknown';
71 const modified = info.time?.modified || 'unknown';
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 165CWE-78
▾
163# Check for install scripts (preinstall, postinstall, prepare)
164node -e "
165 const { execSync } = require('child_process');← spawns a subprocess outside declared capabilities
166 const pkg = require('./package.json');
167 const allDeps = Object.keys({ ...pkg.dependencies, ...pkg.devDependencies });
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 171CWE-78
▾
169 for (const name of allDeps) {
170 try {
171 const info = JSON.parse(execSync('npm view ' + name + ' --json 2>/dev/null', { encoding: 'utf8' }));← spawns a subprocess outside declared capabilities
172 const scripts = info.scripts || {};
173 const risky = ['preinstall', 'install', 'postinstall'].filter(s => scripts[s]);
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 198CWE-78
▾
196# List all licenses
197npx license-checker --summary 2>/dev/null || node -e "
198 const { execSync } = require('child_process');← spawns a subprocess outside declared capabilities
199 const pkg = require('./package.json');
200 const allDeps = Object.keys({ ...pkg.dependencies, ...pkg.devDependencies });
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 204CWE-78
▾
202 for (const name of allDeps) {
203 try {
204 const info = JSON.parse(execSync('npm view ' + name + ' --json 2>/dev/null', { encoding: 'utf8' }));← spawns a subprocess outside declared capabilities
205 console.log(name + ': ' + (info.license || 'UNKNOWN'));
206 } catch {}
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
View latest scan →
skillox.io/c/dependencies-audit