setup-vault
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script (
scripts/setup-vault) to perform repository initialization. It executes standard commands such asgit init,git remote,mkdir,cp, anddiff. These operations are constrained to a subdirectory namedvault/within the workspace root. - [EXTERNAL_DOWNLOADS]: The skill utilizes the GitHub CLI (
gh) to interact with the user's GitHub account for repository creation and checking status. These interactions target a well-known service (GitHub) and are a core part of the skill's intended functionality to sync the knowledge vault. - [DATA_EXPOSURE]: The skill retrieves the current GitHub username using
gh api userto facilitate repository naming. This data is used locally to prompt the user and configure the git remote. The skill explicitly instructions that the repository should be private. - [REMOTE_CODE_EXECUTION]: The script does not download and execute arbitrary code from the internet. All logic is contained within the provided bash script and template files which are part of the skill package.
- [CREDENTIALS_SAFE]: The skill does not store or hardcode any API keys or credentials. It relies on the user's existing authentication state with the GitHub CLI (
gh auth status).
Audit Metadata