secrets
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The bash script at
scripts/secretsfacilitates the execution of arbitrary commands with decrypted environment variables. It uses standard shell execution patterns and includes argument separation for the target command to prevent unexpected behavior. The use of--ensures that user-provided arguments are not misinterpreted by the wrapper.\n- [EXTERNAL_DOWNLOADS]: The documentation references the installation of the@dotenvx/dotenvxpackage from the official npm registry, which is an established developer tool for managing environment secrets. This is presented as a prerequisite rather than a silent download.\n- [CREDENTIALS_UNSAFE]: The skill provides a framework for managing sensitive local credentials. It incorporates strict security measures, such as setting directory permissions to700and file permissions to600viachmod. It also includes explicit safety rules for the agent to avoid printing, committing, or otherwise leaking these values in logs or chat history.\n- [DYNAMIC_EXECUTION]: The provided test suitescripts/tests/test_secrets.pyemploys thesubprocessmodule to verify the behavior of the helper script. It also dynamically generates a mock executable fordotenvxwithin a temporary directory to facilitate regression testing, which is a standard and safe practice for unit testing CLI tools.
Audit Metadata