expanso-cross-border-gdpr
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the
expansoCLI tool and provides instructions to install it from theclawhubregistry. This is a legitimate dependency for the skill's core functionality. - [COMMAND_EXECUTION]: Includes
run.shandtest.shscripts that execute the Expanso CLI and perform configuration validation using tools likeyqorpython3. - [DATA_EXFILTRATION]: The
pipeline.yamlconfiguration is designed to read data from a PostgreSQL database and transfer it to Google Cloud BigQuery. This transfer is the explicitly stated purpose of the skill, and the pipeline incorporates multi-stage anonymization (deleting names/addresses, hashing identifiers with salts, and generalizing timestamps) to protect privacy during the transfer process. - [CREDENTIALS_UNSAFE]: Authentication for the database and cloud storage targets is handled via environment variables (
DB_USER,DB_PASSWORD, etc.), preventing hardcoded secrets. A default saltgdpr-compliance-2024is provided for the anonymization logic, though users are encouraged to provide their own via environment variables.
Audit Metadata