skills/cleanexpo/synthex/scout/Gen Agent Trust Hub

scout

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a local utility script (run.sh) used to validate model retirement dates.
  • The script uses a Node.js heredoc to parse JSON and perform date calculations relative to the current system time.
  • Execution is confined to local project files and standard output; no network requests or access to sensitive user data (like SSH keys or environment variables) are performed.
  • [SAFE]: All file operations are restricted to the project's configuration and library directories.
  • The skill manages .claude/provider-registry.json and model preset files in lib/ai/providers/.
  • Documentation regarding 'BYOK' (Bring Your Own Key) refers to platform architectural considerations and does not involve the exfiltration or exposure of actual credentials.
  • [SAFE]: The skill uses a structured ingestion process for external data.
  • Ingestion points: Reads model metadata from .claude/provider-registry.json.
  • Boundary markers: Uses structured JSON parsing which naturally delimits data from instructions.
  • Capability inventory: Limited to writing to project-specific TypeScript files and registry JSON, plus running the local run.sh script.
  • Sanitization: The script performs type-safe date parsing and string comparison within a controlled JavaScript environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 06:23 PM
Security Audit — agent-trust-hub — scout