openai
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_EXFILTRATION]: The skill manages sensitive API tokens by storing them in a dedicated configuration directory (~/.config/openai/token) outside of the skill repository. It implements security best practices by setting the file permissions to 0600 (read/write only by the owner). Network communication is restricted to the official OpenAI API domain.
- [COMMAND_EXECUTION]: The skill executes local Ruby scripts to perform its tasks. These scripts use standard library components (net/http, json) and do not involve shell interpolation of untrusted inputs, preventing command injection vulnerabilities.
- [EXTERNAL_DOWNLOADS]: All external interactions are directed to well-known OpenAI services. No external code, scripts, or unverifiable dependencies are downloaded or executed by the skill.
- [PROMPT_INJECTION]: The instructions provided in SKILL.md are strictly operational, focusing on the setup process and tool usage. There are no attempts to override agent safety guidelines or hide malicious instructions in the documentation.
Audit Metadata