imp
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/start.pyutilizes thesubprocess.runfunction to executegitandgh(GitHub CLI) commands. These are used to manage local git worktrees, fetch repository metadata, and interact with GitHub issues. The script passes arguments as a list rather than a shell string, which is a security best practice to prevent command injection. - [EXTERNAL_DOWNLOADS]: The instructions in
SKILL.mdmention the use ofnpx @limchihi/harness. This command downloads and executes a package from the NPM registry. This package belongs to the skill author's verified scope and is considered a vendor-owned resource used for environment orientation.
Audit Metadata