pair-agent
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the Bun runtime installation script from the official
bun.shdomain. This is a well-known service, and the skill includes a SHA-256 checksum verification step to ensure the downloaded script has not been tampered with before execution. - [REMOTE_CODE_EXECUTION]: Executes the verified Bun installer to set up the execution environment for the browser tools. This step is only initiated if the user provides consent during the setup phase.
- [COMMAND_EXECUTION]: Employs shell commands to manage environment variables, project metadata (such as
CLAUDE.mdrouting rules), and session persistence. It managesngrokfor exposing the local browser server to remote agents and writes session tokens to specific agent configuration directories. Significant actions are transparently presented to the user via theAskUserQuestiontool for approval. - [DATA_EXFILTRATION]: Features an optional telemetry system that logs anonymous usage statistics, including skill duration and outcomes. The user is prompted to opt-in and choose their desired level of privacy (community, anonymous, or off) upon the skill's first run.
Audit Metadata