gh-setup
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Node.js (spawnSync), Python (subprocess.run), and shell scripts to execute system commands for environment detection, such as identifying the OS, distribution, and active terminal emulator.
- [REMOTE_CODE_EXECUTION]: The skill automates the download and execution of the official Homebrew installation script on macOS and GitHub CLI binaries from the official GitHub releases page. These operations target well-known and reputable infrastructure.
- [EXTERNAL_DOWNLOADS]: As part of its primary setup flow, the skill installs the 'gh-attach' extension from a third-party GitHub repository (sudosubin/gh-attach). This dependency is explicitly documented as required for the skill's image-upload functionality.
- [CREDENTIALS_SAFE]: The implementation includes logic to check for the existence of the 'GH_ATTACH_SESSION_TOKEN' environment variable. The code and documentation explicitly state that this token should never be printed, stored in configuration files, or exfiltrated, adhering to secure secret management practices.
Audit Metadata