here-now
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to transmit local files and directory contents to the external service
https://here.now. This is performed via the./scripts/publish.shand./scripts/drive.shscripts to fulfill its primary purpose of hosting websites and storing cloud data. - [COMMAND_EXECUTION]: The skill executes bundled shell scripts (
publish.sh,drive.sh) to perform API requests and file operations. These scripts utilize standard system binaries includingcurl,jq, andfileto manage data and communicate with the network. - [CREDENTIALS_UNSAFE]: The skill manages service-specific API keys by storing them in a local file at
~/.herenow/credentials. It provides explicit instructions for the agent to write credentials to this file and configures the scripts to read from it for authentication. - [EXTERNAL_DOWNLOADS]: The documentation suggests a setup process using
npx skills add, which involves downloading the skill bundle and its associated scripts from a remote GitHub repository (heredotnow/skill).
Audit Metadata