secrets
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use shell command substitution patterns (e.g.,
$(cat config/master.key)and$(kamal secrets fetch ...)) to dynamically resolve environment variables during the deployment process. - [EXTERNAL_DOWNLOADS]: The documentation references official command-line interfaces and documentation from well-known and trusted services, including 1Password, Bitwarden, AWS Secrets Manager, Google Cloud Secret Manager, Doppler, and Passbolt.
- [CREDENTIALS_UNSAFE]: The skill is specifically designed to manage high-entropy secrets such as
KAMAL_REGISTRY_PASSWORDandRAILS_MASTER_KEY. It mitigates the risk of credential exposure by providing clear instructions on using.gitignoreand vault-based retrieval instead of hardcoding values. - [DATA_EXFILTRATION]: While the skill interacts with sensitive data, it follows a pull-based model from trusted vault providers to the local deployment environment. No patterns for exfiltrating data to untrusted or unknown external domains were identified.
Audit Metadata