knock-cli
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the Knock CLI tool via npm (@knocklabs/cli) or Homebrew (knocklabs/tap/knock). These are standard installation methods for the vendor's official command-line interface.
- [COMMAND_EXECUTION]: A detailed reference of Knock CLI commands is provided, including resource synchronization (pull/push), authentication (login/whoami), and resource management. The instructions correctly advise the use of the --force flag for non-interactive agent execution to prevent hanging on confirmation prompts.
- [DATA_EXFILTRATION]: The skill manages service tokens and template data, which are transmitted to the vendor's API as part of its core functionality. No unauthorized data exfiltration patterns or suspicious third-party domains were identified.
- [INDIRECT_PROMPT_INJECTION]: The skill describes an attack surface where the agent processes local project files (JSON, HTML, Markdown) and API responses to manage notification logic. The instructions mitigate risks by emphasizing that the agent should read existing structures before writing and validate resources locally using the CLI before pushing changes.
Audit Metadata