sync

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the latest version of the dometrain-grounding documentation from raw.githubusercontent.com/Dometrain/mcp. This download targets a well-known service (GitHub) and is used solely for diffing against local content.
  • [COMMAND_EXECUTION]: The skill uses bash to execute a local synchronization script (scripts/update.sh). This script utilizes standard system utilities like curl, diff, sed, and tr to perform its tasks.
  • [SAFE]: The execution path is highly restricted: the skill has disable-model-invocation: true and user-invocable: true, meaning it only runs when a human explicitly triggers it. The default mode is 'report-only', which performs no file writes or modifications. The --refresh-baseline flag, which can modify local files, is not exposed via the skill's primary command dispatch and is intended for manual execution by a maintainer in a development environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 07:55 PM
Security Audit — agent-trust-hub — sync