swapit
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: Local-First Data Storage. The skill stores all sensitive household data (rooms, items, quantities) on the local filesystem in the user's configuration directory (~/.config/swapit/). It does not use cloud storage for personal inventory, ensuring the user remains in control of their data.
- [SAFE]: Privacy-Preserving Architecture. Implements an explicit privacy gate using an allowlist-based anonymizer. This ensures that even when opting into the community 'commons' features, only generic, non-identifying knowledge facts are transmitted, while private structural fields such as specific item names or room locations are strictly filtered out.
- [SAFE]: Secure Local Dashboard. The dashboard server launched by 'swapit serve' is bound exclusively to the loopback interface (127.0.0.1) and designed for single-user local access. It utilizes standard library components and performs HTML escaping on user-provided inputs to mitigate cross-site scripting (XSS) risks.
- [SAFE]: Verified Grounding. The included knowledge base citations point to authoritative public health sources including NIEHS, CDC, EPA, and WHO, providing grounded guidance rather than unverified claims.
- [SAFE]: Minimal Dependency Surface. The core skill runtime utilizes only the Python standard library, effectively eliminating supply-chain risks associated with third-party runtime dependencies.
Audit Metadata