gh-repo-bootstrap
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script executes git and gh commands using subprocess.run with arguments passed as a list. It does not use shell=True, which effectively prevents command injection vulnerabilities even when processing user-provided metadata like repository descriptions or commit messages.
- [DATA_EXFILTRATION]: Data operations are limited to the local filesystem and the official GitHub API via the authenticated gh tool. No evidence was found of sensitive information being transmitted to unauthorized or third-party domains.
- [REMOTE_CODE_EXECUTION]: The skill relies on local scripts and standard library modules. It does not download, install, or execute code from external sources or unverified package registries.
- [SAFE]: The skill includes explicit security measures, such as verifying that the target repository directory is within the intended projects root and using strict regular expressions to validate repository names and owner identifiers.
Audit Metadata