skills/limchihi/harness/imp/Gen Agent Trust Hub

imp

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/start.py utilizes the subprocess.run function to execute git and gh (GitHub CLI) commands. These are used to manage local git worktrees, fetch repository metadata, and interact with GitHub issues. The script passes arguments as a list rather than a shell string, which is a security best practice to prevent command injection.
  • [EXTERNAL_DOWNLOADS]: The instructions in SKILL.md mention the use of npx @limchihi/harness. This command downloads and executes a package from the NPM registry. This package belongs to the skill author's verified scope and is considered a vendor-owned resource used for environment orientation.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 05:34 PM
Security Audit — agent-trust-hub — imp