Passwords
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed as a local password manager that uses robust cryptographic standards, including Argon2id for key derivation and ChaCha20-Poly1305 (via the 'age' utility) for file encryption.
- [DATA_EXFILTRATION]: The skill accesses sensitive local directories (
~/.vault/) and OS-specific secure storage (macOS Keychain, Windows Credential Manager, Linux libsecret). This access is necessary for the skill's primary function and is mitigated by strict rules prohibiting the agent from logging, printing, or including credentials in any output. - [COMMAND_EXECUTION]: The skill requires the 'age' binary to perform its core encryption functions. This is a standard and verifiable security tool.
- [PROMPT_INJECTION]: The skill includes comprehensive 'What Agents Must Not Do' instructions to prevent the agent from leaking sensitive data or being influenced by malicious instructions embedded in external content, such as domain mismatch checks and non-HTTPS warnings.
Audit Metadata