ai-shifu-course-creator
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to run a local utility script,
scripts/shifu-cli.py, which handles all interactions with the AI-Shifu platform API. - [EXTERNAL_DOWNLOADS]: The skill's deployment phase requires standard Python libraries (
requests,python-dotenv) and connects to the vendor's official domainapp.ai-shifu.cnfor course synchronization. - [DATA_EXPOSURE]: Authentication tokens are persisted in a local
.envfile. The provided script follows security best practices by explicitly setting file permissions to0o600(read/write by owner only) to prevent unauthorized access by other local users. - [SAFE_PRACTICE]: The
shifu-cli.pyscript contains asafe_join_pathfunction specifically designed to validate file paths and prevent directory traversal attacks when the agent reads or writes lesson files.
Audit Metadata