ship

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses local shell commands to execute development tools such as npm, pnpm, yarn, git, and grep. These are employed for standard release readiness tasks like running the test suite, verifying the build process, and linting the source code.
  • [CREDENTIALS_UNSAFE]: The skill includes checks for hardcoded credentials (e.g., API_KEY, SECRET, PASSWORD) and environment variable files (.env, .env.production). These actions are diagnostic in nature, aimed at identifying potential security leaks before code is deployed.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes curl to perform health checks and version verification on application endpoints. These are standard post-deployment validation steps.
  • [PROMPT_INJECTION]: The skill processes project metadata and command outputs (like git diff and search results) to compile a summary report. While this constitutes an indirect ingestion of external data, it is a necessary part of the skill's function to report on project status.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 07:36 AM
Security Audit — agent-trust-hub — ship