context-update

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes git commands and calls neighboring scripts context-audit/run.mjs and context-fix/run.mjs. These executions are limited to repo context maintenance and use standard Node.js execFileSync and spawnSync APIs.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads and writes JSON artifacts (plans and findings) strictly within the .git/context-spec directory of the target repository. It does not perform network operations or access sensitive credentials outside of standard Git repository metadata.
  • [REMOTE_CODE_EXECUTION]: The skill calls external scripts (context-audit and context-fix), but these are defined as mandatory separately-installed sibling skills within the local environment. There is no evidence of downloading or executing code from remote sources.
  • [DYNAMIC_EXECUTION]: The script uses spawnSync to invoke other local Node.js scripts using process.execPath. Path resolution is handled via standard Node.js path utilities, and inputs are validated against the repository root.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 12:10 PM
Security Audit — agent-trust-hub — context-update