dotagents-qa
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for building and running Docker containers (
docker build,docker run) to create an isolated QA environment. Within this environment, it executes project-related commands likepnpm install,pnpm build, andpnpm smoke:examplesto verify behavior changes. - [EXTERNAL_DOWNLOADS]: The
Dockerfilefetches the latest versions of official CLI tools from well-known organizations including Anthropic (@anthropic-ai/claude-code) and OpenAI (@openai/codex) via the public NPM registry. - [CREDENTIALS_UNSAFE]: The documentation includes instructions for performing runtime proofs that involve Codex authentication files. It emphasizes security by instructing the user to isolate these in temporary directories within the sandbox and provides explicit warnings to scrub credentials before finishing the QA session.
- [DATA_EXPOSURE]: The skill uses Docker volume mounts to provide the container access to the host repository. It correctly specifies the repository mount as read-only (
ro) to prevent accidental modification of host files during the testing process.
Audit Metadata