setup-ai-build-kit

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONPERSISTENCE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes multiple scripts that execute shell commands to manage local project state, Git repositories, and GitHub resources. Key scripts include scripts/check-tooling.sh, which verifies the presence of required developer tools, and scripts/found-issues.sh, which automates the creation of labels and management of issues via the GitHub CLI.
  • [DYNAMIC_EXECUTION]: The Python scripts guard-secrets.py and redact-secrets.py utilize importlib.util to dynamically load the scan-secrets.py module from the local file system. Furthermore, scripts/codex-with-github.py employs os.execvpe to replace the current process with a new instance of the AI agent harness, passing in a GitHub token via environment variables.
  • [PERSISTENCE]: The skill establishes several hooks to ensure consistent security checks across development sessions. scripts/use-push-guard.sh installs a pre-push Git hook, while templates/foundation/claude-settings.json configures the AI agent harness to execute specific shell scripts (guard-secrets.sh and redact-secrets.sh) whenever file reading, writing, or command execution tools are invoked.
  • [SAFE_PRACTICE]: A significant portion of the skill's code is dedicated to preventing data exposure. The redact-secrets.py script identifies potential secrets in local environment files (.env) and actively masks these values from being returned to the AI agent. The guard-secrets.py script acts as a firewall, denying the agent access to commands that would dump the environment or read sensitive credential files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 10:44 AM