submit-ara

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions provide a fallback curl command to download a submission script from https://www.agenticresearch.sh/s/submit-ara.py. This domain is the official home of the ARA Hub service described in the skill, and the script is a mirror of the one included locally in the skill package.
  • [REMOTE_CODE_EXECUTION]: The skill uses curl | python3 to execute the aforementioned submit-ara.py script if the local version is missing. This is the intended delivery mechanism for this research tool and originates from the vendor's primary domain.
  • [COMMAND_EXECUTION]: The skill executes various system commands including git, gh (GitHub CLI), and python3 to manage research artifacts. The scripts/submit.py script performs file system walking, data encoding, and network requests via urllib to interact with the ARA Hub API.
  • [SAFE]: The skill implements proactive data protection by maintaining a list of excluded files (SKIP_NAMES, SKIP_SUFFIXES) that prevents the accidental upload of private keys, environment variables, and authentication credentials. It also enforces local file permissions (0o600) and updates .gitignore to protect the generated update tokens.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 03:43 AM