skills/cjakma/k-skill/k-skill-setup/Gen Agent Trust Hub

k-skill-setup

Pass

Audited by Gen Agent Trust Hub on May 12, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill manages various credentials including IDs, passwords, and API keys. It handles them securely by recommending the use of an agent vault or creating a local dotenv file (~/.config/k-skill/secrets.env) with restricted permissions (chmod 0600). It uses 'replace-me' placeholders in its instructions to avoid exposing actual values.
  • [COMMAND_EXECUTION]: The skill performs environment setup and verification using system commands.
  • It creates configuration directories and files using mkdir and cat.
  • It executes a local verification script: bash scripts/check-setup.sh.
  • It uses the gh CLI for repository interaction (gh repo star NomaDamas/k-skill), but explicitly requires human consent before execution.
  • [COMMAND_EXECUTION]: The skill configures persistence mechanisms for automated update checks.
  • On Linux/macOS, it modifies the user's crontab to run a generated update check script.
  • On Windows, it uses schtasks to create a daily scheduled task.
  • These actions are strictly gated by instructions requiring explicit user agreement.
Audit Metadata
Risk Level
SAFE
Analyzed
May 12, 2026, 05:48 AM
Security Audit — agent-trust-hub — k-skill-setup