trello
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
cyeamCLI to interact with Trello. The instructions explicitly forbid the AI from constructing direct HTTP requests or guessing IDs. It mandates using established CLI commands likecyeam trello login,boards, andcards. These operations are standard for the skill's purpose and include user confirmation for actions that change state. - [CREDENTIALS_SAFE]: The skill implements a secure credential flow. It instructs the user to provide an API key via
cyeam trello login, which then stores tokens in the system keychain or a restricted file (~/.cyeam/trello.jsonwith0600permissions). It explicitly commands the agent to never output these credentials. - [DATA_EXPOSURE]: The skill handles Trello attachments by downloading them locally via the CLI (
--out <local-path>) rather than passing raw URLs or sensitive data directly to third-party interfaces (like Feishu/Lark). This prevents 401/403 errors and ensures authentication is handled securely by the CLI environment.
Audit Metadata