master-schedule

Pass

Audited by Gen Agent Trust Hub on May 11, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: Uses basic Bash commands to check for the existence and content of the project-local configuration file canoa.json.
  • [EXTERNAL_DOWNLOADS]: References a Google Sheets template ID for the purpose of duplicating a product library. Interaction with Google services is performed via the Model Context Protocol (MCP), which is an established and safe integration pattern.
  • [DATA_EXFILTRATION]: Reads and writes configuration data to canoa.json within the project root. All network interactions are limited to official Google Sheets API endpoints through the user-configured MCP server.
  • [CREDENTIALS_UNSAFE]: Provides documentation on how users should securely configure their Google Service Account credentials within the MCP settings file (~/.claude/mcp_settings.json), which aligns with standard security practices for managing secrets in this platform.
Audit Metadata
Risk Level
SAFE
Analyzed
May 11, 2026, 11:58 AM
Security Audit — agent-trust-hub — master-schedule