kickoff-patch

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes several system utilities to perform its tasks, including git for version control operations, composer for PHP package management, npm for frontend dependencies, php artisan for Laravel framework commands, and jq for manipulating JSON configuration and markers.\n- [EXTERNAL_DOWNLOADS]: To obtain the update baselines, the skill fetches repository data, tags, and file trees from GitHub (github.com/cleaniquecoders/kickoff). This includes shallow clones of specific tags to facilitate 3-way merges and fetching version metadata via the GitHub API.\n- [REMOTE_CODE_EXECUTION]: The skill implements a mechanism to synchronize imperative changes (like new packages or artisan commands) by parsing the logic within a remote PHP file (StartCommand.php) from the Kickoff repository. It calculates the delta between the project's baseline version and the latest version to suggest and execute corresponding composer require and php artisan commands.\n- [DATA_EXFILTRATION]: While the skill reads project configuration and environment templates (.env.example), it includes explicit safety guidelines to avoid modifying or accessing live environment secrets (.env) and limits network interactions to the official source repository.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 05:59 AM
Security Audit — agent-trust-hub — kickoff-patch