skill-sync
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill references the use of
apm-cliversion0.28.0via theuvxpackage runner to handle skill synchronization and installation. This tool appears to be a core component of the author's development ecosystem. - [DATA_EXPOSURE_AND_EXFILTRATION]: Instructions are provided for managing sensitive credentials (such as
GH_TOKEN) using environment variables stored in~/.secrets.d/. This practice aligns with standard security recommendations to avoid hardcoding secrets within agent configurations or skill code. - [COMMAND_EXECUTION]: The skill documentation includes standard shell commands for package management (
apm install,apm update) and the creation of symbolic links (ln -sf) to manage agent JSON configurations on the host machine.
Audit Metadata