scout
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a local utility script (
run.sh) used to validate model retirement dates. - The script uses a Node.js heredoc to parse JSON and perform date calculations relative to the current system time.
- Execution is confined to local project files and standard output; no network requests or access to sensitive user data (like SSH keys or environment variables) are performed.
- [SAFE]: All file operations are restricted to the project's configuration and library directories.
- The skill manages
.claude/provider-registry.jsonand model preset files inlib/ai/providers/. - Documentation regarding 'BYOK' (Bring Your Own Key) refers to platform architectural considerations and does not involve the exfiltration or exposure of actual credentials.
- [SAFE]: The skill uses a structured ingestion process for external data.
- Ingestion points: Reads model metadata from
.claude/provider-registry.json. - Boundary markers: Uses structured JSON parsing which naturally delimits data from instructions.
- Capability inventory: Limited to writing to project-specific TypeScript files and registry JSON, plus running the local
run.shscript. - Sanitization: The script performs type-safe date parsing and string comparison within a controlled JavaScript environment.
Audit Metadata