goal-mode
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local bash script,
scripts/goal-notify.sh, to display macOS notifications. This script invokesosascript, a standard macOS utility for executing AppleScript, which is a common practice for desktop integration. - [COMMAND_EXECUTION]: The notification script accepts user-provided input (the task condition and status updates) and interpolates it into AppleScript commands. To prevent injection attacks, the script implements an
escfunction that correctly escapes double quotes (s/"/\\"/g), ensuring the payload remains within the intended AppleScript string literal. - [SAFE]: The skill's behavior aligns perfectly with its stated purpose of wrapping the native
/goalcommand with periodic progress updates. No remote code execution, external downloads, data exfiltration, or persistence mechanisms were detected. - [SAFE]: The
allowed-toolslist is restricted to standard file and shell operations necessary for the skill's function, and no suspicious metadata or obfuscated content is present.
Audit Metadata