cairo-vulnerability-scanner Eval report.

Task wording matches this skill metadata.

• Evaluate cairo-vulnerability-scanner before installing it in an agent workflow
• security
• Security and compliance workflows; Claude Code teams; teams that value GitHub adoption signals

Install handoff is available.

• npx skills add trailofbits/skills --skill cairo-vulnerability-scanner

standard package or runtime install path

• npx skills add trailofbits/skills --skill cairo-vulnerability-scanner

Good trust signals with a few areas worth checking before rollout.

• Strong shortlist
• 6.8K GitHub stars
• CC-BY-SA-4.0

Risky

• Dependency or permission surface needs review

This skill should not be selected by an agent without explicit human security review.

• Do not auto-install. Inspect the source, dependencies, and permission surface first.
• Audit risk exceeds the requested agent policy

CC-BY-SA-4.0

• CC-BY-SA-4.0

secrets or environment access, shell or command execution

• Shell or command execution: high
• Network access: medium
• Filesystem access: medium