log-hours
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Executes local git commands (
git log) and CLI tools (gh auth status,az account show) to gather activity data for timesheet generation. These are standard operations for the skill's primary purpose. - [CREDENTIALS_SAFE]: Correctly instructs users to store sensitive API tokens in environment variables (
TEMPO_API_TOKEN) rather than hardcoding them. It implements a fallback to a local config file if the environment variable is missing. - [DATA_EXPOSURE]: Accesses Jira activity, Git history across local repositories, and Outlook calendar data. This is necessary for the stated purpose of deducing work hours and is performed using the agent's authorized tools.
- [SAFE]: Implements a mandatory human-in-the-loop approval step (Step 6 and Step 8) before performing any write operations to external systems.
Audit Metadata