permacc
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the
!commandsyntax inSKILL.mdto execute a shell script at load time. - Evidence:
!d=${CLAUDE_SKILL_DIR}; command -v skill-toc >/dev/null 2>&1 && exec skill-toc "$d"; s=$HOME/.claude/skills/plugin-utils/bin/skill-toc; [ -x "$s" ] && exec "$s" "$d"; echo "(skill-toc unavailable...)"` - Context: This command is used to generate a Table of Contents for the skill's references and scripts using a standard utility (
skill-toc). While it executes at load time, it is a benign documentation helper and does not exfiltrate data or access sensitive files. - [COMMAND_EXECUTION]: The skill provides instructions and examples for executing a Python script via
uv runto manage archives. - Evidence:
uv run --script "$PC" status,uv run --script "$PC" archive URL... --auto-folder - Context: This is the intended primary purpose of the skill. The script
scripts/permacc.pyuses standard library modules and therequestslibrary to interact with the official perma.cc API. - [CREDENTIALS_SAFE]: The skill handles API keys but follows security best practices.
- Evidence: The skill instructs users to store keys in environment variables (
PERMACC_API_KEY) or files (PERMACC_API_KEY_FILE) rather than hardcoding them. It specifically mentions usingagenixfor secret management, which is a standard secure practice for Nix-based environments.
Audit Metadata