commet-cli
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions and reference files describe several shell commands using the
commetCLI tool. These includecommet login,commet link,commet pull,commet push, andcommet create. These are documented as standard operations for managing billing configurations and project templates. - [EXTERNAL_DOWNLOADS]: The skill references downloading project templates from GitHub when running
commet create. Specifically, the documentation mentions that templates are fetched from the vendor's repository (commet-labs/skills) and allows users to specify a Git reference via the--refflag. These are documented as official vendor resources. - [CREDENTIALS_UNSAFE]: The documentation references how the CLI handles authentication. It mentions that
commet loginstores credentials in~/.commet/auth.jsonandcommet linkcreates.commet/config.jsoncontaining an API key. The instructions correctly advise adding.commet/to.gitignoreto prevent accidental credential exposure, which is a security best practice.
Audit Metadata