atproto-deploy

Fail

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [CREDENTIALS_UNSAFE]: A hardcoded administrative token is present in the SKILL.md file: ADMIN_TOKEN="grimlock-admin-f5f3ef8419386713454c05b8d475cce1". This token is included in example curl commands used to authenticate requests to the agent network's management API.
  • [COMMAND_EXECUTION]: The skill uses npx to execute build and deployment tools: npx wrangler deploy for Cloudflare Workers, npx vite build for the dashboard application, and npx turbo typecheck and npx vitest run for pre-deployment checks.
  • [DATA_EXFILTRATION]: The skill uses curl to interact with remote APIs at agent-network.joelhooks.workers.dev. While these target the author's project infrastructure, the use of these commands in conjunction with the hardcoded administrative token facilitates unauthorized remote data modification and access.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jun 20, 2026, 06:36 AM
Security Audit — agent-trust-hub — atproto-deploy