paper-know-journal
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses a dedicated initialization script (
init_workspace.py) that implements strict path normalization and relative path checks (ensure_within) to prevent path traversal vulnerabilities during workspace setup. - [SAFE]: A validation utility (
validate_report.py) is integrated into the workflow to automatically scan the final Markdown report for the presence of internal task paths, hidden directory names, or test evidence, preventing accidental information disclosure. - [SAFE]: The skill's operational instructions include a mandatory "Common Constraints" section that prohibits the recording of API keys, access tokens, passwords, cookies, or any personal identifying information (PII) within the task workspace.
- [SAFE]: Data ingestion practices are governed by a defined source policy (
references/source-policy.md) that requires the separation of official journal facts from community feedback and utilizesyaml.safe_load()for configuration management to mitigate deserialization risks. - [SAFE]: Error reporting and bug tracking are handled through a controlled process that uses vendor-specific resources and requires explicit user authorization before interacting with external repositories via tools like the GitHub CLI.
Audit Metadata