alm-install
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_SAFE]: The skill explicitly follows secure practices by instructing users to store PATs and API tokens in the macOS Keychain or Windows user environment variables. It avoids capturing these secrets in the chat or placing them directly in configuration files, instead using environment variable references like
${env:VAR}. - [COMMAND_EXECUTION]: The skill uses local system commands (
security,launchctl,SetEnvironmentVariable) to manage environment variables and persistence mechanisms. These are necessary for the stated purpose of ensuring the MCP server can access the required tokens across agent restarts. - [DATA_EXPOSURE]: The skill documents access to agent configuration files such as
.cursor/mcp.jsonand~/.claude.json. This access is scoped to the installation and repair of MCP server entries and includes logic to backup existing files before modification to prevent data loss. - [REMOTE_CODE_EXECUTION]: The skill configures MCP servers to run via standard package runners (
npx,uvx) or Docker. The referenced packages (@azure-devops/mcpandmcp-atlassian) are standard tools for these integrations.
Audit Metadata