create-honeytokens
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute installation scripts directly from GitGuardian's official GitHub repository (github.com/GitGuardian/ggshield) using shell and PowerShell interpreters. These are standard procedures for the initial setup of the vendor's CLI tool.
- [PRIVILEGE_ESCALATION]: Installation steps include the use of sudo for package managers (apt, dnf) and system installers (.pkg) to correctly deploy the ggshield binary to system-wide paths.
- [DYNAMIC_EXECUTION]: The skill leverages ggshield's 'create-with-context' feature to generate realistic, language-specific code modules (e.g., Python, TypeScript) that wrap honeytoken credentials, helping them appear as authentic decoy credentials to potential attackers.
- [COMMAND_EXECUTION]: Interacts with the local environment by executing ggshield commands to check API status, verify token scopes, and generate the honeytoken strings and files.
- [EXTERNAL_DOWNLOADS]: Fetches standalone binaries, packages, and configuration files from GitGuardian's official GitHub releases and well-known service endpoints (api.github.com).
Audit Metadata