compose-dividend-distribution

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads application templates and contracts from the vendor's official GitHub repository.
  • Evidence: Commands such as npx -y degit goldsky-io/documentation-examples/compose/corporate-actions and git clone https://github.com/goldsky-io/documentation-examples.git are used to fetch the source code.
  • [COMMAND_EXECUTION]: The skill leverages the official Goldsky CLI for application lifecycle management, including deployment and contract interaction.
  • Evidence: The instructions guide the user through the use of goldsky compose deploy, goldsky compose deployContract, and goldsky compose writeContract commands.
  • [DATA_EXFILTRATION]: The application communicates with official vendor APIs and database services through secure, platform-controlled channels.
  • Evidence: Network requests are made to https://api.goldsky.com and POSTGRES_CONNECTION_STRING is used for database operations via the ctx.fetch IPC mechanism.
  • [CREDENTIALS_UNSAFE]: The skill provides clear instructions for handling sensitive API keys and database secrets using the platform's native secret management tools, avoiding hardcoded credentials.
  • Evidence: Guidance is provided on using goldsky compose secret set GOLDSKY_PROJECT_KEY and managing GOLDSKY_API_TOKEN via environment variables rather than hardcoding them in scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 07:04 PM
Security Audit — agent-trust-hub — compose-dividend-distribution