twinmind-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the dynamic execution pattern in its documentation to provide immediate environment feedback, running standard system commands such as
uname -aand version checks for Node.js and Python. These are used strictly for diagnostic visibility. - [COMMAND_EXECUTION]: The instructions include bash commands to run a local TypeScript diagnostic script via
npx ts-nodeand severalcurlcommands to verify the health and configuration of the TwinMind API. These operations target the vendor's own infrastructure. - [CREDENTIALS_UNSAFE]: While the skill processes the
TWINMIND_API_KEYfrom environment variables, it follows a secure diagnostic pattern by only including a short prefix (8 characters) in the generated debug bundle, preventing the accidental exfiltration of the full secret. - [EXTERNAL_DOWNLOADS]: The skill recommends using
npxto execute the diagnostic runner, which involves fetching thets-nodepackage from the official npm registry, a well-known and trusted service.
Audit Metadata