project-claude-config
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
WebFetchto validate canonical documentation anchors fromcode.claude.comfor proposed harness items. This is a targeted, read-only operation used for integrity verification of technical keys and events. - [COMMAND_EXECUTION]: The skill uses an internal 'Explore' subagent to run shell commands (reading manifests, file trees, and configuration files) to gather project facts. These operations are limited to data discovery to inform the audit process and do not include arbitrary execution of untrusted code.
- [SAFE]: The skill explicitly enforces 'deny-only' permission models and prohibits the creation of 'allowlists,' maintaining the security posture of the underlying platform.
- [SAFE]: The skill includes logic to detect and flag attempts to bypass or weaken global security guards (e.g.,
read-guard,secret-guard). - [SAFE]: Instructions are provided to avoid hardcoding secrets in environment variables or configuration files, specifically advising against putting secrets in
settings.json.
Audit Metadata