use-native-credential-proxy
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill enables an alternative credential management path. It moves API keys and tokens from a secure vault into local environment files (.env) and threads them into Docker containers as environment variables. The author explicitly documents this as a security 'anti-pattern' compared to the default vault and provides clear warnings and a removal process.
- [COMMAND_EXECUTION]: The instructions use standard shell utilities (such as
cp,sed,grep, andlaunchctl/systemctl) to integrate the proxy logic into the existing project. These operations are performed locally and are strictly limited to the skill's stated purpose of modifying the local codebase and configuration. - [CREDENTIALS_UNSAFE]: While the skill facilitates the handling of sensitive API keys and OAuth tokens, it does so through standard environment variable practices. There are no signs of credential exfiltration or hardcoded secrets. The instructions correctly guide the user to input their own credentials locally.
Audit Metadata