eightctl
Warn
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
eightctlbinary directly from a third-party GitHub repository (github.com/steipete/eightctl/cmd/eightctl@latest) during the installation phase. This creates a dependency on external code that is not maintained by the skill author or a known trusted organization. - [COMMAND_EXECUTION]: The skill relies on the execution of the
eightctlCLI tool to interact with the Eight Sleep API. The agent is instructed to run commands likestatus,temp,alarm, andaudiowhich manipulate physical hardware and user schedules. - [DATA_EXPOSURE]: The skill documentation describes accessing sensitive user credentials stored in environment variables (
EIGHTCTL_EMAIL,EIGHTCTL_PASSWORD) and local configuration files (~/.config/eightctl/config.yaml). While storing secrets in environment variables is standard practice, the agent's involvement in processing these credentials increases the surface area for potential exposure.
Audit Metadata