zj-research
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto execute Node.js and Python processes. This is the primary intended function of the skill—acting as an adapter for theZHarnessresearch toolchain. The execution is constrained to a specific pinned artifact and specific protocols (zj-research-cli/v1). - [EXTERNAL_DOWNLOADS]: The skill downloads a compiler artifact from the author's GitHub repository (
jununfly/ZHarness). This behavior is transparently documented inartifacts/compiler-lock.jsonandreferences/research-cli.md. The integrity of the download is verified using SHA-256 hash validation before extraction or execution. - [SAFE]: While the skill interacts with the GitHub API, it includes robust preflight checks for rate limits and authentication. It handles sensitive data like
GITHUB_TOKENusing standard environment variables and follows best practices for secret management. The use of shell execution in tests and adapter scripts is scoped to the tool's core purpose of running a research compiler.
Audit Metadata