depot-general
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references downloads for the Depot CLI from official sources including Homebrew (
depot/tap/depot), GitHub (github.com/depot/*), and GitHub Container Registry (ghcr.io/depot/*). It also includes a proto plugin definition hosted on the vendor's GitHub repository. These are legitimate resources provided by the official vendor. - [COMMAND_EXECUTION]: Provides instructions for local CLI commands (
depot login,depot projects,depot cache reset). The instructions include explicit security warnings to avoid piping network responses directly into a shell and to state URLs before execution, which are recommended security practices. - [DATA_EXFILTRATION]: Documentation describes the use of authentication tokens and OIDC trust relationships for authentication. It appropriately identifies commands that print tokens to the console or delete resources as high-impact operations and suggests requiring explicit user confirmation, which helps prevent accidental data exposure or resource loss.
Audit Metadata