ql-housekeep
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses several bash commands (grep, find, git, jq, awk) to inspect the local repository state. These commands are restricted to read-only or metadata-gathering operations (e.g.,
git worktree list,grep -rn,find . -name). - [DYNAMIC_EXECUTION]: A small Python script is used inline within a bash command to perform date arithmetic for the 'Stale quantum.json' check. The input to this script is the
updatedAtfield from a localquantum.jsonfile, and the execution is confined to date processing. - [DATA_EXPOSURE_&_EXFILTRATION]: While the skill reads local configuration files like
quantum.jsonand.claude-plugin/plugin.json, it does not perform any network operations or external data transmission. All findings are reported to the local stdout for the user. - [NO_REMOTE_CODE]: The skill does not download external scripts or packages. It relies entirely on pre-installed system utilities (git, python3, jq, grep).
Audit Metadata