skills/commet-labs/skills/commet-cli/Gen Agent Trust Hub

commet-cli

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions and reference files describe several shell commands using the commet CLI tool. These include commet login, commet link, commet pull, commet push, and commet create. These are documented as standard operations for managing billing configurations and project templates.
  • [EXTERNAL_DOWNLOADS]: The skill references downloading project templates from GitHub when running commet create. Specifically, the documentation mentions that templates are fetched from the vendor's repository (commet-labs/skills) and allows users to specify a Git reference via the --ref flag. These are documented as official vendor resources.
  • [CREDENTIALS_UNSAFE]: The documentation references how the CLI handles authentication. It mentions that commet login stores credentials in ~/.commet/auth.json and commet link creates .commet/config.json containing an API key. The instructions correctly advise adding .commet/ to .gitignore to prevent accidental credential exposure, which is a security best practice.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 02:59 PM
Security Audit — agent-trust-hub — commet-cli