kickoff-patch
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several system utilities to perform its tasks, including
gitfor version control operations,composerfor PHP package management,npmfor frontend dependencies,php artisanfor Laravel framework commands, andjqfor manipulating JSON configuration and markers.\n- [EXTERNAL_DOWNLOADS]: To obtain the update baselines, the skill fetches repository data, tags, and file trees from GitHub (github.com/cleaniquecoders/kickoff). This includes shallow clones of specific tags to facilitate 3-way merges and fetching version metadata via the GitHub API.\n- [REMOTE_CODE_EXECUTION]: The skill implements a mechanism to synchronize imperative changes (like new packages or artisan commands) by parsing the logic within a remote PHP file (StartCommand.php) from the Kickoff repository. It calculates the delta between the project's baseline version and the latest version to suggest and execute correspondingcomposer requireandphp artisancommands.\n- [DATA_EXFILTRATION]: While the skill reads project configuration and environment templates (.env.example), it includes explicit safety guidelines to avoid modifying or accessing live environment secrets (.env) and limits network interactions to the official source repository.
Audit Metadata