skills/edwinhu/workflows/permacc/Gen Agent Trust Hub

permacc

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command syntax in SKILL.md to execute a shell script at load time.
  • Evidence: !d=${CLAUDE_SKILL_DIR}; command -v skill-toc >/dev/null 2>&1 && exec skill-toc "$d"; s=$HOME/.claude/skills/plugin-utils/bin/skill-toc; [ -x "$s" ] && exec "$s" "$d"; echo "(skill-toc unavailable...)"`
  • Context: This command is used to generate a Table of Contents for the skill's references and scripts using a standard utility (skill-toc). While it executes at load time, it is a benign documentation helper and does not exfiltrate data or access sensitive files.
  • [COMMAND_EXECUTION]: The skill provides instructions and examples for executing a Python script via uv run to manage archives.
  • Evidence: uv run --script "$PC" status, uv run --script "$PC" archive URL... --auto-folder
  • Context: This is the intended primary purpose of the skill. The script scripts/permacc.py uses standard library modules and the requests library to interact with the official perma.cc API.
  • [CREDENTIALS_SAFE]: The skill handles API keys but follows security best practices.
  • Evidence: The skill instructs users to store keys in environment variables (PERMACC_API_KEY) or files (PERMACC_API_KEY_FILE) rather than hardcoding them. It specifically mentions using agenix for secret management, which is a standard secure practice for Nix-based environments.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 10:35 AM