submit-ara
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions provide a fallback
curlcommand to download a submission script fromhttps://www.agenticresearch.sh/s/submit-ara.py. This domain is the official home of the ARA Hub service described in the skill, and the script is a mirror of the one included locally in the skill package. - [REMOTE_CODE_EXECUTION]: The skill uses
curl | python3to execute the aforementionedsubmit-ara.pyscript if the local version is missing. This is the intended delivery mechanism for this research tool and originates from the vendor's primary domain. - [COMMAND_EXECUTION]: The skill executes various system commands including
git,gh(GitHub CLI), andpython3to manage research artifacts. Thescripts/submit.pyscript performs file system walking, data encoding, and network requests viaurllibto interact with the ARA Hub API. - [SAFE]: The skill implements proactive data protection by maintaining a list of excluded files (
SKIP_NAMES,SKIP_SUFFIXES) that prevents the accidental upload of private keys, environment variables, and authentication credentials. It also enforces local file permissions (0o600) and updates.gitignoreto protect the generated update tokens.
Audit Metadata