expanso-production-log-pipeline
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust log processing pipeline with security-conscious features. Specifically:
- [DATA_EXPOSURE_AND_EXFILTRATION]: It uses environment variables (e.g.,
${ELASTICSEARCH},${S3_BUCKET},${ALERT_WEBHOOK}) for all external service destinations, avoiding hardcoded credentials. It also includes active PII redaction using regex for emails, SSNs, and credit card numbers, and hashes IP addresses before storage. - [COMMAND_EXECUTION]: The
run.shandtest.shscripts perform standard operations for the tool's intended purpose, such as running theexpansoCLI and validating YAML syntax. - [DYNAMIC_EXECUTION]: The
test.shscript usesyaml.safe_load()when validating via Python, which is a security best practice to prevent unsafe deserialization. - [EXTERNAL_DOWNLOADS]: The skill references documentation and examples from
expanso.io, which is the vendor's own domain.
Audit Metadata