showSecurityAudits fetches and displays security risk assessments from the skills.sh partner audit API (Gen Agent Trust Hub, Socket, Snyk). This is best-effort with a short timeout — failures are silently ignored.
(ctx context.Context, meta *registry.SkillMeta)
| 987 | // the skills.sh partner audit API (Gen Agent Trust Hub, Socket, Snyk). |
| 988 | // This is best-effort with a short timeout — failures are silently ignored. |
| 989 | func (sh *SkillHandler) showSecurityAudits(ctx context.Context, meta *registry.SkillMeta) { |
| 990 | // Extract source (owner/repo) and skill slug from the full ID |
| 991 | parts := strings.SplitN(meta.Slug, "/", 3) |
| 992 | if len(parts) < 3 { |
| 993 | return |
| 994 | } |
| 995 | source := strings.Join(parts[:2], "/") |
| 996 | skillSlug := parts[2] |
| 997 | |
| 998 | auditData, err := registry.FetchAuditData(ctx, source, []string{skillSlug}) |
| 999 | if err != nil { |
| 1000 | sh.logger.Debug("failed to fetch audit data", zap.Error(err)) |
| 1001 | return |
| 1002 | } |
| 1003 | |
| 1004 | // Look up the audit for our skill |
| 1005 | data, ok := auditData[skillSlug] |
| 1006 | if !ok { |
| 1007 | // Try with the full name as fallback |
| 1008 | data, ok = auditData[meta.Name] |
| 1009 | if !ok { |
| 1010 | return |
| 1011 | } |
| 1012 | } |
| 1013 | |
| 1014 | fmt.Printf(" %s\n", colorize(i18n.T("skill.info.security")+":", ColorCyan)) |
| 1015 | |
| 1016 | // Gen Agent Trust Hub (ATH) |
| 1017 | athLabel := "--" |
| 1018 | athColor := ColorGray |
| 1019 | if data.ATH != nil { |
| 1020 | athLabel = registry.FormatRiskLevel(data.ATH.Risk) |
| 1021 | athColor = riskColor(data.ATH.Risk) |
| 1022 | } |
| 1023 | fmt.Printf(" %-22s %s\n", |
| 1024 | colorize("Gen Agent Trust Hub:", ColorGray), |
| 1025 | colorize(athLabel, athColor)) |
| 1026 | |
| 1027 | // Socket |
| 1028 | socketLabel := "--" |
| 1029 | socketColor := ColorGray |
| 1030 | if data.Socket != nil { |
| 1031 | socketLabel = registry.FormatSocketAlerts(data.Socket) |
| 1032 | if data.Socket.Alerts > 0 { |
| 1033 | socketColor = ColorRed |
| 1034 | } else { |
| 1035 | socketColor = ColorGreen |
| 1036 | } |
| 1037 | } |
| 1038 | fmt.Printf(" %-22s %s\n", |
| 1039 | colorize("Socket:", ColorGray), |
| 1040 | colorize(socketLabel, socketColor)) |
| 1041 | |
| 1042 | // Snyk |
| 1043 | snykLabel := "--" |
| 1044 | snykColor := ColorGray |
| 1045 | if data.Snyk != nil { |
| 1046 | snykLabel = registry.FormatRiskLevel(data.Snyk.Risk) |
no test coverage detected