verona-oauth2-client
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with the local environment by executing the
verona-toolkitCLI. The automation scriptsrotate-secret.shandsync-from-treasury.shutilize safe Bash array expansion ("${CMD_ARGS[@]}") for command invocation. This approach ensures that user-provided parameters (such as client IDs) are treated as literal arguments rather than executable code, effectively mitigating shell injection risks. - [CREDENTIALS_UNSAFE]: While the skill manages sensitive OAuth2 client secrets, it does so with appropriate safeguards. Secrets are redacted by default in all outputs, and the skill includes clear instructional warnings about the importance of secure storage and the one-time display of secrets during creation or rotation. No hardcoded credentials or unsafe exposure patterns were detected.
- [EXTERNAL_DOWNLOADS]: The skill specifies dependencies on other trusted components from the same vendor (
verona-toolkit-init,verona-oauth2) but does not perform any independent external downloads or remote script execution. All network operations are proxied through the authenticated vendor CLI tools.
Audit Metadata