stash-encryption
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation guides the user to install
@cipherstash/stackvia standard package managers and to usenpxto execute vendor-provided tools likestash init. These are legitimate dependencies provided by the author of the skill. - [COMMAND_EXECUTION]: Multiple command-line examples are provided using the
stashCLI (e.g.,stash status,stash plan,stash encrypt backfill). These commands are standard administrative operations for managing the encryption lifecycle within the CipherStash ecosystem. - [CREDENTIALS_UNSAFE]: The documentation describes the use of environment variables (
CS_CLIENT_KEY,CS_CLIENT_ACCESS_KEY) for authentication in CI/production environments. It correctly identifies these as secrets and explicitly warns the user never to commit them to version control, which is an industry-standard safety practice. - [PERSISTENCE]: The skill mentions that the CLI stores authentication tokens in the user's home directory (
~/.cipherstash/auth.json). This is the standard mechanism for the vendor's CLI tool to maintain a session across commands.
Audit Metadata