notte-functions-build
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with 'notte.cc' and 'anything.notte.cc' (marketplace) to manage browser sessions and deploy functions. These are vendor-owned domains associated with the skill's primary purpose.
- [COMMAND_EXECUTION]: The skill uses the 'notte' CLI to execute browser commands, create cloud functions, and manage authentication. All command patterns ('notte auth', 'notte functions create', etc.) are standard operations for this toolset.
- [CREDENTIALS_UNSAFE]: The documentation explicitly instructs users NOT to hardcode secrets or pass them as variables. It mandates the use of 'notte functions secrets set' and 'os.environ' for secure credential management.
- [REMOTE_CODE_EXECUTION]: While the skill deploys code to a cloud environment ('notte functions create'), this is the primary intended functionality of a deployment skill. It includes a 'self-test' phase to verify script integrity before finalization.
- [DATA_EXFILTRATION]: No evidence of unauthorized data exfiltration. Network operations ('curl' to 'api.notte.cc') are used solely for invoking the vendor's API endpoints as designed.
Audit Metadata