develop-bug
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The installation and setup scripts (
install-hooks.shanddevelop-pipeline-install-hooks.sh) utilize bash process substitution to download and execute a remote setup script (setup-consumer.sh) from the author's GitHub repository. - [COMMAND_EXECUTION]: The skill executes a wide range of shell commands (
git,gh,curl,python3,jq,stat,mktemp) to manage the repository, interact with tracker APIs, and manage pipeline lock states. - [EXTERNAL_DOWNLOADS]: Fetches setup utilities and configuration files from the author's official GitHub repository (
Gamaroff/agent-skills) during initialization and updates. - [DATA_EXPOSURE]: Accesses sensitive credentials for GitHub, Jira, and Bitbucket stored in environment variables or
.envfiles. To mitigate risk, the skill employs a dedicated redaction engine indefer-mutation.jsto ensure secrets are scrubbed from log files before they are committed to the repository.
Audit Metadata