why-tree
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes Python (tests/build_fixtures.py, tests/adapt_smoke.py) and Node.js (tests/plumbing.test.mjs) scripts. These are clearly labeled as a 'token-frugal' testing and plumbing harness intended to validate the skill's data structures and visualization template without incurring LLM costs.
- [EXTERNAL_DOWNLOADS]: The research component of the workflow uses well-known search and scraping tools (Exa and Firecrawl) to retrieve competitive data and public documentation. This activity is restricted to the sources explicitly authorized or provided by the user during the initial setup phase.
- [DATA_EXFILTRATION]: While the skill reads sensitive local data (such as database query results and internal files) to perform its diagnosis, this data is processed internally within the agent's context to generate the 'Why Tree'. There is no evidence of the data being sent to unauthorized external domains.
- [PROMPT_INJECTION]: The PROMPT.md and SKILL.md files contain detailed instructions to ensure the agent maintains analytical rigor (e.g., 'Refute before you trust'). These instructions serve to guide the agent's reasoning process and do not attempt to override the platform's underlying safety or operational guidelines.
Audit Metadata