tk-pr-triage
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
gh apiandgit remotecommands via a local Node.js script to fetch pull request metadata and determine the repository origin. These operations are limited to read-only access and are necessary for the skill's primary function of PR triaging. - [DATA_EXPOSURE]: The skill accesses a local configuration file at
$XDG_CONFIG_HOME/tigerkit/pr-triage.jsonor~/.config/tigerkit/pr-triage.json. This file is used to store a list of repository identifiers and is managed within the user's local profile, following standard application configuration patterns. - [SAFE]: The analysis confirms that all external interactions are performed using the authenticated
ghCLI tool, targeting only the repositories explicitly configured by the user or derived from the current repository's Git origin. No sensitive data exfiltration or unauthorized mutation of GitHub resources was detected.
Audit Metadata