agent-config-sync
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/sync.pyutility usesshutil.which()to detect the presence of local CLI tools (e.g.,claude,codex,cursor) as part of its environment discovery process. This is used solely for inventorying installed tools and does not involve executing arbitrary commands. - [EXTERNAL_DOWNLOADS]: The
config.jsonfile includes reference URLs to official documentation for various agent platforms (e.g.,docs.anthropic.com,docs.cursor.com). These are used as metadata for the 'learning mechanism' to verify configuration paths and are not downloaded or executed at runtime by the script. - [DATA_EXPOSURE]: The skill is designed to read and modify sensitive configuration files located in user home and application support directories (e.g.,
~/.claude/profiles/,%APPDATA%/Claude/). This access is necessary for the skill's primary purpose of configuration synchronization. All operations are local, and there are no network-based exfiltration patterns detected in the provided code.
Audit Metadata