buzz
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use various CLI tools, including the project-specific
buzzCLI,git,docker-compose, and thejustbuild runner to manage project lifecycle and operations. - [INDIRECT_PROMPT_INJECTION]: The skill identifies the risk of processing untrusted data from external sources (Nostr relays) and provides explicit instructions to treat such data as non-executable content, mitigating potential injection attacks from channel messages or PR bodies.
- [SAFE]: All external references and downloads target the official GitHub repository for the Buzz project or well-known services like GitHub Container Registry, which are considered safe sources.
- [SAFE]: The skill incorporates strong security guidelines, advising the agent to keep private keys (like
BUZZ_PRIVATE_KEY) out of logs, code, and commits, and to use environment variables for sensitive configuration.
Audit Metadata