ql-housekeep

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses several bash commands (grep, find, git, jq, awk) to inspect the local repository state. These commands are restricted to read-only or metadata-gathering operations (e.g., git worktree list, grep -rn, find . -name).
  • [DYNAMIC_EXECUTION]: A small Python script is used inline within a bash command to perform date arithmetic for the 'Stale quantum.json' check. The input to this script is the updatedAt field from a local quantum.json file, and the execution is confined to date processing.
  • [DATA_EXPOSURE_&_EXFILTRATION]: While the skill reads local configuration files like quantum.json and .claude-plugin/plugin.json, it does not perform any network operations or external data transmission. All findings are reported to the local stdout for the user.
  • [NO_REMOTE_CODE]: The skill does not download external scripts or packages. It relies entirely on pre-installed system utilities (git, python3, jq, grep).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 03:24 AM