od-contribute

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill includes an install.sh script designed to be run via curl | bash. This script fetches the latest version of the skill by downloading the nexu-io/open-design repository archive from GitHub and extracting the necessary instruction and script files to the agent's local directory.
  • [EXTERNAL_DOWNLOADS]: The installation process and the workspace setup logic download repository tarballs and file metadata directly from GitHub's official servers.
  • [COMMAND_EXECUTION]: The skill executes a series of shell scripts to automate the contribution process. This includes check-prereqs.sh for environment validation, setup-workspace.sh for cloning the repository and managing branches, and create-pr.sh / create-issue.sh for interacting with the GitHub CLI (gh).
  • [CREDENTIALS_UNSAFE]: To support sandboxed environments where the GitHub CLI might not have access to the system keychain, the skill includes logic to read an authentication token from a local .gh-token file stored within the skill's own directory. The installation script applies a chmod 600 permission to this file to restrict access.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 08:10 AM
Security Audit — agent-trust-hub — od-contribute