jev-agent-setup
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto execute git commands (git rev-parse --show-toplevel) for identifying project roots to localize logging. This is a standard development workflow practice. - [DATA_EXPOSURE_EXFILTRATION]: While the skill facilitates network calls to
api.typesafe.aivia thejevCLI, this is the primary intended purpose of the skill. The installer explicitly avoids handling real API keys, instead creating a 0600-permissioned local environment file (~/.config/typesafe/env) for the user to populate manually. - [PRIVILEGE_ESCALATION]: The installer uses
chmodto set executable bits on the installed CLI tool and strict permissions (0600) on configuration and log files. These are restricted to the current user's home directory and do not involve administrative privilege escalation. - [PERSISTENCE]: The skill modifies global agent instruction files (e.g.,
CLAUDE.md,AGENTS.md) to include a managed instruction block. This is the stated purpose of the skill to ensure persistent agent behavior across sessions. It uses clear markers and provides an uninstaller to revert these changes.
Audit Metadata