Skills
Navigate
skills/carpenter-singh-lab/vignette-catalog-skills/vignette-catalog-setup/Gen Agent Trust Hub

vignette-catalog-setup

Pass

Audited by Gen Agent Trust Hub on Jul 12, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill installs the uv package manager by downloading a shell script from the official Astral domain (astral.sh) and piping it directly to a shell.
  • [REMOTE_CODE_EXECUTION]: The helper script scripts/register-session.py utilizes the uv run shebang to dynamically provision the websockets library at runtime.
  • [EXTERNAL_DOWNLOADS]: The skill installs the marimo-pair extension using the npx skills add command to enable drive-a-live-kernel capabilities.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to manage background server processes, discover listening ports via lsof, and modify system resource limits (ulimit) to support parallel compilation.
  • [SAFE]: The skill implements safety guidelines for secret handling, explicitly instructing the agent to avoid inlining credentials on the command line to prevent exposure in process logs or shell history.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 12, 2026, 01:49 PM
Security Audit — agent-trust-hub — vignette-catalog-setup