hydra-head
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the exclamation syntax in its metadata to run a version check command (
hydra-node --version) when the skill is loaded. This is a standard environment detection practice and is considered safe. - [EXTERNAL_DOWNLOADS]: A helper script in the
scripts/directory is designed to pull a container image fromghcr.io, which is a well-known container registry. The image belongs to the project's official organization and the reference is used for legitimate containerized execution. - [COMMAND_EXECUTION]: The documentation provides instructions for running a local bash script to manage keys and node operations. The script functions as a wrapper for the hydra-node executable or its Docker equivalent, which is consistent with the skill's stated purpose.
Audit Metadata