dosu
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the Dosu CLI by executing a script fetched from the vendor's official GitHub repository (
raw.githubusercontent.com/dosu-ai/dosu-cli/main/install.sh). It also utilizes the@dosu/clipackage from the npm registry. - [COMMAND_EXECUTION]: Executes a variety of subcommands via the
dosuCLI to perform platform operations such asdosu setup,dosu ask,dosu docs, anddosu review. It also performs codebase inspection using standard Git and file system commands during the audit workflow. - [DATA_EXFILTRATION]: Manages platform authentication by retrieving and storing Supabase access tokens and API keys locally. These credentials are used to authorize requests to the Dosu platform's tRPC and backend services.
- [PROMPT_INJECTION]: The skill processes untrusted data from external sources, including documentation from platforms like Notion and Confluence, as well as conversation threads from GitHub and Slack. To mitigate risks associated with indirect prompt injection, the skill enforces safety protocols requiring the agent to display content diffs and obtain explicit user confirmation (
--confirm) before approving or applying changes.
Audit Metadata