agent-dev-workflow

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides Bash scripts in the references/bin/ directory that automate environment setup and process management. These scripts use standard system utilities such as docker, git, and ps. For example, references/bin/_common.sh uses docker run and docker exec to manage the lifecycle of a shared Postgres container, while app_dev_stop utilizes kill with process group IDs (-$pid) to supervise stack teardown. The use of eval in bin/dev-fullstack is constrained to specific, internally defined environment variable keys for tracking session state.
  • [EXTERNAL_DOWNLOADS]: The bin/setup script facilitates environment onboarding by running bun install for Node.js dependencies and asdf install for tool versioning. It also supports fetching database snapshots from Google Cloud Storage using gcloud storage cat. These actions target reputable registries and official tools as part of the intended developer workflow.
  • [CREDENTIALS_UNSAFE]: Hardcoded development credentials (APP_PG_USER="app", APP_PG_PASSWORD="app") are present in references/bin/_common.sh. These are standard defaults for isolated local development containers and are common in scaffolding templates.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 09:37 PM
Security Audit — agent-trust-hub — agent-dev-workflow