debt-sentinel
Warn
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONNO_CODE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute an external Python script (
/a0/usr/plugins/debt-sentinel/debt-sentinel.py) via theBashtool whenever code edits occur. This script is not provided within the skill package, preventing verification of its behavior. - [COMMAND_EXECUTION]: The troubleshooting documentation suggests running
chmod +xon the external script path, which is a privilege-related command used to grant execution permissions to files. - [NO_CODE]: The core logic, including the enforcement script and its configuration files (
ANTI_PATTERNS.md,DEBT.md), is missing from the skill distribution, making it an empty shell that relies on pre-existing local files. - [DATA_EXPOSURE_SURFACE]: The skill is designed to scan all file edits (
Edit(*)orWrite(*)) and log violations to a local file (DEBT.md). This broad access to the file system creates a surface where sensitive data encountered during edits could be unintentionally logged or handled by the unverified script.
Audit Metadata