od-contribute
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes an
install.shscript designed to be run viacurl | bash. This script fetches the latest version of the skill by downloading thenexu-io/open-designrepository archive from GitHub and extracting the necessary instruction and script files to the agent's local directory. - [EXTERNAL_DOWNLOADS]: The installation process and the workspace setup logic download repository tarballs and file metadata directly from GitHub's official servers.
- [COMMAND_EXECUTION]: The skill executes a series of shell scripts to automate the contribution process. This includes
check-prereqs.shfor environment validation,setup-workspace.shfor cloning the repository and managing branches, andcreate-pr.sh/create-issue.shfor interacting with the GitHub CLI (gh). - [CREDENTIALS_UNSAFE]: To support sandboxed environments where the GitHub CLI might not have access to the system keychain, the skill includes logic to read an authentication token from a local
.gh-tokenfile stored within the skill's own directory. The installation script applies achmod 600permission to this file to restrict access.
Audit Metadata