cerbos-hub-setup
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's scripts utilize
npx -y cerbosctlto dynamically download and run the official Cerbos CLI if it is not present on the system path. This targets a well-known registry (NPM) for the vendor's own tooling. - [EXTERNAL_DOWNLOADS]: Deployment instructions pull official Cerbos Docker images from the GitHub Container Registry (
ghcr.io/cerbos/cerbos). - [COMMAND_EXECUTION]: The skill executes local shell scripts and vendor-specific CLI tools (
cerbosctl,docker) to manage policy stores and PDP instances. - [CREDENTIALS_UNSAFE]: While the skill manages sensitive API secrets (
CERBOS_HUB_CLIENT_SECRET), it implements best-practice safeguards. It explicitly instructs the agent to never output secrets, provides commands for the user to securely set environment variables (usingread -rs), and includes logic inscripts/check-prereqsto verify if a secret is set while explicitly withholding its value from the output. - [SAFE]: No malicious patterns, prompt injections, or unauthorized data exfiltration attempts were detected. The skill is consistent with its stated purpose of managing Cerbos Hub infrastructure.
Audit Metadata