agent-config-fanout
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill defines a framework for 'runners' which are command templates executed by agent CLIs. These are used to normalize and publish events from various tools like Claude Code and Copilot to a central service.
- [EXTERNAL_DOWNLOADS]: The skill manages 'skill packs' which are retrieved from external git repositories. The architecture includes a 'sealed' pack mechanism that mandates SHA256 integrity checks for all files in a payload and rejects any that contain symlinks to prevent directory escaping.
- [DATA_EXPOSURE]: The engine interacts with and modifies agent-specific configuration files (e.g.,
~/.claude/settings.json,~/.copilot/hooks.json). The documentation specifies security invariants to ensure these operations remain within project-scoped or agent-specific boundaries and do not clobber unrelated user settings.
Audit Metadata