agent-deadline-setup

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash and node tools to perform installation, status monitoring, and configuration management. These operations are scoped to the project's .claude directory and the global Claude Code settings directory (~/.claude).
  • [DYNAMIC_EXECUTION]: The skill's runbook (INSTALL.md) executes Node.js snippets via node -e to handle JSON merging and metadata stamping. These scripts operate on local files using parameters passed through environment variables, which is a common pattern for installer skills in this environment.
  • [PERSISTENCE]: The skill achieves persistence by modifying the Claude Code settings.json file to register PreToolUse and SubagentStop hooks. This is the intended and documented purpose of the skill.
  • [DATA_EXPOSURE]: The hooks manage state information in the system's temporary directory (os.tmpdir()). The implementation includes defensive measures such as verifying file ownership (UID checks), enforcing restricted permissions (mode 0o700), and sanitizing identifiers to prevent directory traversal and symlink attacks in shared temporary environments.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 06:23 PM
Security Audit — agent-trust-hub — agent-deadline-setup