verify-against-source
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFE
Full Analysis
- Source Code Retrieval via GitHub API: The skill instructs the agent to use
gh apito fetch repository content. This is a standard method for accessing source code for verification purposes. It includes a step to decode base64 content, which is the default format for file data returned by the GitHub API. These actions are performed within the vendor's own repository ecosystem. - Local Execution of Code Samples: The skill suggests using
make test-code-samplesanduv runto verify that code snippets work as described. This involves executing code locally to confirm behavior. While this involves command execution, it is scoped to the specific purpose of testing documented code samples within a development environment. - Access to Internal/Private Repositories: The instructions acknowledge that some claims may require checking private repositories using existing GitHub credentials. This reflects a standard developer workflow where the agent acts with the user's permissions to verify internal technical details.
Audit Metadata