sync-melech-skills
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Python
subprocessmodule to orchestrate skill management by executing the Vercel Skills CLI (npx skills) and internal utility scripts. These commands are executed with the working directory set to the user's home folder to prevent project-specific configuration hijacking. - [EXTERNAL_DOWNLOADS]: The skill connects to the GitHub API and raw content domains (
api.github.comandraw.githubusercontent.com) to retrieve the latest skill catalog and documentation from the author's repository. This information is used for version comparison and displaying skill descriptions. - [DATA_EXPOSURE]: To maintain synchronization, the skill reads the local agent configuration file at
~/.agents/.skill-lock.jsonand audits skill installation paths within common agent directories (e.g.,.cursor,.claude,.agents). This access is limited to the purpose of identifying installed versions and agents.
Audit Metadata