agent-alerts-setup
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill correctly instructs the user NOT to paste API tokens into the chat. It specifically recommends using a dedicated secret manager (AGENTALERTS_AGENT_TOKEN) or a restricted local file (~/.config/agent-alerts/token.env) with 0600 permissions to store the sensitive token.
- [COMMAND_EXECUTION]: The skill references a bundled helper script
send_webhook.sh. These commands are used for configuration validation and smoke testing of the notification service. The skill explicitly warns against granting broad shell access and recommends authorizing only the absolute path of the helper script. - [EXTERNAL_DOWNLOADS]: The skill directs users to a specific setup domain (andreas.ink) to generate tokens. As the author of the skill is 'AndreasInk', this is a legitimate vendor resource for the service being configured and does not represent an untrusted third-party download.
- [DATA_EXFILTRATION]: Outbound HTTPS is restricted to the specific webhook endpoint provided by the setup page. The instructions emphasize that the token should never be included in URLs, query strings, or logs, preventing accidental leakage during transmission.
Audit Metadata