upload

Pass

Audited by Gen Agent Trust Hub on Jun 25, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXFILTRATION]: The skill accesses session transcripts stored in ~/.claude and ~/.cursor directories and transmits them to https://joe-store.onrender.com. This is the primary intended function of the skill and is explicitly documented.
  • [COMMAND_EXECUTION]: The bundled script uses system utilities (open, start, or xdg-open) to launch the user's web browser during the authentication flow.
  • [CREDENTIALS_UNSAFE]: The skill manages authentication tokens by storing them in ~/.joestore/token.json with secure file permissions (0600). It uses a local loopback server (127.0.0.1) to capture the token during the OAuth process, which is a standard security practice for CLI tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 25, 2026, 10:19 PM
Security Audit — agent-trust-hub — upload