turn-eta
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill implements a task-tracking and estimation system. It maintains performance logs in a local
.etadirectory within the project root to refine future time predictions based on the specific model and provider used. - [COMMAND_EXECUTION]: The agent is instructed to execute local Node.js scripts (
eta.jsandeta-gate.js) to initialize plans, log progress, and record task completion times. These scripts perform standard filesystem operations within the working directory. - [SAFE]: The skill includes security best practices such as path sanitization (slugging) to ensure that dynamically generated directory names for models and providers do not result in directory traversal or other filesystem vulnerabilities.
- [SAFE]: The hook script (
eta-gate.js) processes the agent's conversation transcript and tool outputs to verify compliance with planning instructions. This processing is performed locally to manage the internal state of the skill and does not involve external data exfiltration.
Audit Metadata