delonet-daily-report
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a local reporting tool that collects data from deterministic sources such as git logs, systemctl, and local user files.
- [SAFE]: It employs structural allowlisting via the
collectors.base.allowlistfunction to ensure only specifically reviewed fields from external data sources reach the report or the narrator LLM. - [SAFE]: The narration component explicitly uses a contained toolset (
-t todo) when invoking the Hermes CLI, which prevents the model from accessing the shell or filesystem even if a prompt injection occurs in the source data. - [SAFE]: Sensitive credentials for external services, such as the Resend API, are retrieved via environment variables or 1Password's command-line interface (
op read), avoiding hardcoded secrets in the configuration files. - [SAFE]: All third-party text is processed through a defensive escaper (
escape_untrusted_text) before being rendered in the final Markdown reports, effectively neutralising potential forgeries of authority markers or Markdown block structures.
Audit Metadata