user-profile-keeper
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed for local-only use. The instructions in
SKILL.mdand the privacy policy inreferences/privacy-boundary.mdexplicitly prohibit data uploads or network communication. The onboarding WebUI (scripts/onboarding_webui.py) is restricted to the local loopback address (127.0.0.1). - [CREDENTIALS_UNSAFE]: The skill proactively prevents the storage of sensitive credentials.
scripts/onboarding_webui.pycontains a robust redaction mechanism (SECRET_PATTERNS) that uses regular expressions to detect and block OpenAI keys, GitHub tokens, AWS credentials, and other secrets from being saved to the user profile. - [COMMAND_EXECUTION]: The skill executes local Python scripts (
profile_store.py,onboarding_webui.py) for profile management and user onboarding. These scripts use standard library modules and relative paths, avoiding arbitrary shell execution or remote code downloads. - [SAFE]: The skill follows security best practices for local data storage, including setting restrictive file permissions (0700 for directories and 0600 for the SQLite database) and using atomic write operations for data integrity.
Audit Metadata