apm-usage
Pass
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions enable the agent to fetch and install skills, instructions, and MCP servers from remote Git providers such as GitHub and GitLab using the
apm installcommand. - [COMMAND_EXECUTION]: The skill defines a manifest schema (
apm.yml) that supports ascriptsfield and apostinstallhook. These allow for the execution of arbitrary shell commands through theapm runinterface or automatically after a successful installation. - [DATA_EXFILTRATION]: Instructions specify how to handle authentication via
gh auth,git credential, and environment variables likeGITHUB_APM_PAT. While necessary for private repository access, these patterns involve the handling of sensitive credentials. - [SAFE]: The skill includes security-conscious features such as an
apm auditcommand and a--dry-runflag for previewing changes before execution.
Audit Metadata