0xkey-keyops-coordinator
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads an operator-specific CLI binary from the vendor's official GitHub repository. The
scripts/fetch_qos_client.pyscript ensures binary integrity by verifying its SHA256 hash against a sidecar before execution. - [COMMAND_EXECUTION]: The
scripts/enclave_keyops.pyscript executes various system utilities, includingkubectl,aws, andykman, to manage the deployment environment and interface with hardware security tokens. - [EXTERNAL_DOWNLOADS]: Software components and version metadata are fetched from GitHub's infrastructure. These downloads are restricted to the author's known repositories and are verified for integrity.
- [SAFE]: Extensive security controls are implemented throughout the skill, such as audit log redaction for sensitive flags, path traversal prevention for archive extraction, and strict rules against co-locating private keys with the working directory.
Audit Metadata