stash-encryption

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation guides the user to install @cipherstash/stack via standard package managers and to use npx to execute vendor-provided tools like stash init. These are legitimate dependencies provided by the author of the skill.
  • [COMMAND_EXECUTION]: Multiple command-line examples are provided using the stash CLI (e.g., stash status, stash plan, stash encrypt backfill). These commands are standard administrative operations for managing the encryption lifecycle within the CipherStash ecosystem.
  • [CREDENTIALS_UNSAFE]: The documentation describes the use of environment variables (CS_CLIENT_KEY, CS_CLIENT_ACCESS_KEY) for authentication in CI/production environments. It correctly identifies these as secrets and explicitly warns the user never to commit them to version control, which is an industry-standard safety practice.
  • [PERSISTENCE]: The skill mentions that the CLI stores authentication tokens in the user's home directory (~/.cipherstash/auth.json). This is the standard mechanism for the vendor's CLI tool to maintain a session across commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 09:18 PM