github-repo-management
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto interact with the GitHub API and executes shell commands for repository management. These are localized to the user's intended interaction with GitHub. - [REMOTE_CODE_EXECUTION]: Automated scans flagged a pattern where
curloutput is piped topython3. Analysis shows this is used exclusively for parsing JSON responses from the official GitHub API (api.github.com) using one-line Python scripts (e.g.,import sys,json; print(json.load(sys.stdin)['login'])). This is a common and safe pattern for data processing in shell environments. - [CREDENTIALS_SAFE]: The skill documents how to retrieve the
GITHUB_TOKENfrom standard local sources like.envor.git-credentials. This is the recommended practice for managing local secrets for development tools. - [TRUSTED_VENDORS]: All network operations target GitHub's official API (
https://api.github.com), which is a well-known and trusted service.
Audit Metadata