jev-agent-setup

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to execute git commands (git rev-parse --show-toplevel) for identifying project roots to localize logging. This is a standard development workflow practice.
  • [DATA_EXPOSURE_EXFILTRATION]: While the skill facilitates network calls to api.typesafe.ai via the jev CLI, this is the primary intended purpose of the skill. The installer explicitly avoids handling real API keys, instead creating a 0600-permissioned local environment file (~/.config/typesafe/env) for the user to populate manually.
  • [PRIVILEGE_ESCALATION]: The installer uses chmod to set executable bits on the installed CLI tool and strict permissions (0600) on configuration and log files. These are restricted to the current user's home directory and do not involve administrative privilege escalation.
  • [PERSISTENCE]: The skill modifies global agent instruction files (e.g., CLAUDE.md, AGENTS.md) to include a managed instruction block. This is the stated purpose of the skill to ensure persistent agent behavior across sessions. It uses clear markers and provides an uninstaller to revert these changes.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 10:47 AM