setup-ai-build-kit
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes multiple scripts that execute shell commands to manage local project state, Git repositories, and GitHub resources. Key scripts include
scripts/check-tooling.sh, which verifies the presence of required developer tools, andscripts/found-issues.sh, which automates the creation of labels and management of issues via the GitHub CLI. - [DYNAMIC_EXECUTION]: The Python scripts
guard-secrets.pyandredact-secrets.pyutilizeimportlib.utilto dynamically load thescan-secrets.pymodule from the local file system. Furthermore,scripts/codex-with-github.pyemploysos.execvpeto replace the current process with a new instance of the AI agent harness, passing in a GitHub token via environment variables. - [PERSISTENCE]: The skill establishes several hooks to ensure consistent security checks across development sessions.
scripts/use-push-guard.shinstalls apre-pushGit hook, whiletemplates/foundation/claude-settings.jsonconfigures the AI agent harness to execute specific shell scripts (guard-secrets.shandredact-secrets.sh) whenever file reading, writing, or command execution tools are invoked. - [SAFE_PRACTICE]: A significant portion of the skill's code is dedicated to preventing data exposure. The
redact-secrets.pyscript identifies potential secrets in local environment files (.env) and actively masks these values from being returned to the AI agent. Theguard-secrets.pyscript acts as a firewall, denying the agent access to commands that would dump the environment or read sensitive credential files.
Audit Metadata