lore-dev-verification

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions and examples for executing shell commands such as npm run check, npm run test, and the provided validation script scripts/validate-workflow-skill.mjs. The script itself uses spawnSync to bootstrap itself using the local repository's tsx binary when TypeScript source needs to be executed directly.
  • [REMOTE_CODE_EXECUTION]: The script scripts/validate-workflow-skill.mjs utilizes dynamic import() to load validation modules from computed local paths within the repository's dist/ or src/ directories. This is a standard development practice for loading tool logic based on the repository's build state.
  • [DATA_EXFILTRATION]: Documentation in references/verification-matrix.md references the sensitive local path ~/.lore/lore.db for local testing. The skill mitigates potential data exposure risks by including explicit rules and warnings across multiple files that prohibit the commitment of real transcripts, credentials, or private memory to the repository.
  • [SAFE]: No malicious patterns, external network exfiltration, or unauthorized data access were detected. The skill's operations are consistent with its declared purpose as a development and verification tool for the Lore repository infrastructure.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 12:15 AM
Security Audit — agent-trust-hub — lore-dev-verification