vendor-reference
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to manage a local
.vendor/directory and ensure it is excluded from git history. It executesgrepandprintfto update the.gitignorefile andgit cloneto fetch the source code. These are standard development operations for the intended purpose of the skill. - [EXTERNAL_DOWNLOADS]: The skill clones source code from user-specified repository URLs (e.g., from GitHub) to provide ground-truth analysis material. It uses shallow clones (
--depth 1) and blob filtering to minimize the local footprint. This behavior is transparently described and gated by user input for the target library and repository.
Audit Metadata