lore-dev-verification
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions and examples for executing shell commands such as
npm run check,npm run test, and the provided validation scriptscripts/validate-workflow-skill.mjs. The script itself usesspawnSyncto bootstrap itself using the local repository'stsxbinary when TypeScript source needs to be executed directly. - [REMOTE_CODE_EXECUTION]: The script
scripts/validate-workflow-skill.mjsutilizes dynamicimport()to load validation modules from computed local paths within the repository'sdist/orsrc/directories. This is a standard development practice for loading tool logic based on the repository's build state. - [DATA_EXFILTRATION]: Documentation in
references/verification-matrix.mdreferences the sensitive local path~/.lore/lore.dbfor local testing. The skill mitigates potential data exposure risks by including explicit rules and warnings across multiple files that prohibit the commitment of real transcripts, credentials, or private memory to the repository. - [SAFE]: No malicious patterns, external network exfiltration, or unauthorized data access were detected. The skill's operations are consistent with its declared purpose as a development and verification tool for the Lore repository infrastructure.
Audit Metadata