report-sdk-issue
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with an external endpoint at
https://sdk-issue-reports.decentraland.org. This is a well-known service domain belonging to the skill's author (Decentraland) and is used for its intended purpose of receiving bug reports. - [DATA_EXFILTRATION]: The skill transmits technical reports to an external service. To mitigate risks, the skill implements a mandatory consent flow, prompting the user for permission before any data is sent. Additionally, the
scripts/report.mjsscript contains an extensive redaction engine that uses regex patterns to strip out sensitive information, including private keys, credentials, email addresses, and local file paths, before transmission. - [COMMAND_EXECUTION]: The skill utilizes a local Node.js script (
scripts/report.mjs) to manage reporting logic. This script performs file system operations (read/write/rename) within a specific hidden directory (.dcl-sdk-reports/) to maintain a local ledger of reported issues and user consent. It also useschild_process.spawnto run background tasks of itself, but does not execute arbitrary shell commands or untrusted external code.
Audit Metadata