cofounder-ssh-key-rotation
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to manage files and generate cryptographic keys using
ssh-keygen. It extensively utilizes the GitHub CLI (gh) to retrieve repository metadata, update sensitive secrets, and initiate remote automation workflows. - [CREDENTIALS_UNSAFE]: The skill performs read and write operations within the
~/.ssh/directory to rotate repository-specific SSH keys. It implements security best practices by immediately applying restrictive permissions (chmod 600) to newly created private keys. - [EXTERNAL_DOWNLOADS]: It creates and commits a GitHub Actions workflow that references an external reusable workflow hosted at
locaweb/locaweb-cloud-provision. This resource belongs to the skill's authoring organization and is used for its intended administrative purpose. - [COMMAND_EXECUTION]: The skill exhibits an indirect injection surface by downloading JSON artifacts from previous workflow runs (
provision-output.json) and interpolating values, such as IP addresses, directly into SSH command strings for verification. While this is a common pattern in automation, it relies on the integrity of the downloaded artifact content.
Audit Metadata