olares-publish
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several external dependencies required for its image processing and blockchain interaction tasks. These include Python packages such as 'Pillow', 'numpy', 'scipy', 'cairosvg', 'realesrgan', and 'basicsr'. It also utilizes the '@beclab/olaresid' Node.js package for identity management. All identified dependencies are standard libraries or vendor-specific tools corresponding to the skill's purpose.
- [COMMAND_EXECUTION]: The skill uses local scripts ('generate_icon.py' and 'render_promo.py') to process images. These scripts use 'Pillow' and 'numpy' for deterministic image manipulation and can optionally interface with the OpenAI API for enhanced promotional image rendering if an API key is provided by the user. The skill also guides the user through using the 'olares-cli' and 'did-cli' for manifest validation and on-chain registration.
- [DATA_EXPOSURE]: The skill includes a 'submission workflow' that specifically instructs the agent to search for and verify that no hardcoded credentials (passwords, secrets, tokens, API keys) or sensitive files (.env, .pem, .key) are present in the application folder before it is submitted to the public repository. This serves as a defensive measure against accidental data exposure.
- [SAFE]: The skill's handling of sensitive operations, such as paid app setup, is designed with a 'human-in-the-loop' approach. It explicitly warns the agent not to handle wallet mnemonics or private keys directly and instead provides instructions for the user to perform these high-privilege actions manually.
Audit Metadata