k-skill-setup
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill manages various credentials including IDs, passwords, and API keys. It handles them securely by recommending the use of an agent vault or creating a local dotenv file (
~/.config/k-skill/secrets.env) with restricted permissions (chmod 0600). It uses 'replace-me' placeholders in its instructions to avoid exposing actual values. - [COMMAND_EXECUTION]: The skill performs environment setup and verification using system commands.
- It creates configuration directories and files using
mkdirandcat. - It executes a local verification script:
bash scripts/check-setup.sh. - It uses the
ghCLI for repository interaction (gh repo star NomaDamas/k-skill), but explicitly requires human consent before execution. - [COMMAND_EXECUTION]: The skill configures persistence mechanisms for automated update checks.
- On Linux/macOS, it modifies the user's
crontabto run a generated update check script. - On Windows, it uses
schtasksto create a daily scheduled task. - These actions are strictly gated by instructions requiring explicit user agreement.
Audit Metadata