setup-cms
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several Python scripts (
cms_detect.py,preflight_wordpress.py, etc.) via the shell. These scripts are stored in a path defined by a shared preamble ($SKILL_SCRIPTS). While the skill passes user-provided credentials into the environment, they are not directly interpolated as shell arguments, which reduces the risk of command injection. - [CREDENTIALS_UNSAFE]: The skill is designed to handle sensitive credentials including WordPress Application Passwords, Strapi API Tokens, and Contentful Delivery Tokens. It follows safe practices by instructing the user to store these in a
.env.localfile rather than hardcoding them. It also explicitly guides users to create scoped or revocable credentials (e.g., WordPress Application Passwords) to minimize risk.
Audit Metadata