tk-implement
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a 'Ready ticket' workflow with extensive safety checks. It explicitly forbids external network operations ('push, publish, 다른 workflow/skill invoke는 금지한다') and restricts file modifications to a specific 'owned path' defined in the ticket.
- [SAFE]: It includes strict boundary markers for data processing. The skill mandates reading from specific local configuration files (
.tigerkit/tickets.md,.tigerkit/implement.md) and requires that it only proceed if the ticket status is exactlyReadyand all metadata (model,effort,lineage) is resolved. - [SAFE]: The execution model is highly controlled, requiring manual invocation (
/tk-implementor$tk-implement) and disabling implicit model invocation in the frontmatter (disable-model-invocation: true). - [SAFE]: There is no evidence of command injection, credential harvesting, or persistence mechanisms. The skill focus is on atomic git commits and local 'receipt' generation within the workspace environment.
Audit Metadata