show-me-your-work
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a bash script
scripts/log.shto manage local decision logs in TSV format. The script uses standard system utilities such asmkdir,printf,date, andtrto safely append rows to a file. - [DATA_EXFILTRATION]: The skill is designed to store a decision trail locally (
decisions.tsv). It includes explicit instructions to the agent to avoid committing secrets, credentials, or private transcript content to the log. Furthermore, it incorporates anunsloprequirement and a self-audit phase to verify that no sensitive information is leaked. - [SAFE]: The skill demonstrates security awareness by implementing a
clean()function in its logging script to mitigate CSV/TSV injection attacks. This function strips newlines and tabs and escapes characters that could be interpreted as formulas in spreadsheet software (e.g.,=,+,-,@). No obfuscation, remote code execution, or privilege escalation patterns were found.
Audit Metadata