verasic-github-governance-init
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/factory.shexecutes several child scripts (e.g.,bootstrap-repo.sh,wire-hooks.sh,doctor.sh) located in the siblingverasic-github-governanceskill directory. This orchestration is the primary purpose of the skill and is gated behind a mandatory--yesflag to prevent accidental execution. - [COMMAND_EXECUTION]: The skill uses
gitandgh(GitHub CLI) commands to manage repository state and open Pull Requests. It safely sources environment variables from a separateverasic-github-cli-initskill rather than hardcoding tokens, following a least-privilege approach to secret management. - [SAFE]: The
SKILL.mdfile correctly restricts model autonomy by settingdisable-model-invocation: true, ensuring the agent cannot execute the factory script without human oversight. - [SAFE]: The repository provides integrity verification files (
integrity.sha256,integrity.txt) to ensure the local scripts have not been tampered with.
Audit Metadata