skills/kevinslin/agstack/secrets/Gen Agent Trust Hub

secrets

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The bash script at scripts/secrets facilitates the execution of arbitrary commands with decrypted environment variables. It uses standard shell execution patterns and includes argument separation for the target command to prevent unexpected behavior. The use of -- ensures that user-provided arguments are not misinterpreted by the wrapper.\n- [EXTERNAL_DOWNLOADS]: The documentation references the installation of the @dotenvx/dotenvx package from the official npm registry, which is an established developer tool for managing environment secrets. This is presented as a prerequisite rather than a silent download.\n- [CREDENTIALS_UNSAFE]: The skill provides a framework for managing sensitive local credentials. It incorporates strict security measures, such as setting directory permissions to 700 and file permissions to 600 via chmod. It also includes explicit safety rules for the agent to avoid printing, committing, or otherwise leaking these values in logs or chat history.\n- [DYNAMIC_EXECUTION]: The provided test suite scripts/tests/test_secrets.py employs the subprocess module to verify the behavior of the helper script. It also dynamically generates a mock executable for dotenvx within a temporary directory to facilitate regression testing, which is a standard and safe practice for unit testing CLI tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 07:26 AM