lov-add-tool
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a secure profile storage mechanism via
scripts/profile_store.py, which explicitly blacklists sensitive keys such as tokens, secrets, and passwords, while utilizing atomic file writes with restrictive permissions (0o600) to protect user data. - [SAFE]: A specialized validation script (
scripts/validate_skill.py) is provided to maintain skill quality and security, checking for absolute user file paths, unresolved placeholders, and manifest schema compliance. - [SAFE]: The workflow instructions for the AI agent include specific security boundaries, such as requiring explicit user authorization for sending notifications and preventing the inheritance of legacy service domains or broadcast addresses that could lead to malicious redirection.
- [SAFE]: AI billing and API cost estimation logic is handled transparently, with instructions to use sandbox environments and verified pricing logic from local project configurations, mitigating the risk of unexpected financial impact.
Audit Metadata