card-widget

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/fetch_todo_reminders.py executes osascript to interface with the macOS Reminders application. This is a legitimate functional requirement to display the user's tasks on the e-ink screen. The script includes an escape function to mitigate potential injection within the AppleScript execution.
  • [COMMAND_EXECUTION]: The scripts/install_firmware.py script uses esptool.py via a subprocess call to flash firmware to the M5Paper device. This is a standard operation for managing ESP32-based hardware.
  • [EXTERNAL_DOWNLOADS]: The scripts/install_firmware.py script provides a mechanism to download firmware binaries from a user-supplied URL. It implements a security check requiring a SHA256 hash, which is verified against the downloaded file before any flashing operations occur to ensure file integrity.
  • [DATA_EXPOSURE]: The skill accesses local system data such as macOS Reminders and system resource metrics (CPU, Memory). This data is communicated solely to a local daemon running on 127.0.0.1:9877 for rendering on the connected e-ink display, representing a local-only data flow.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 10:34 AM
Security Audit — agent-trust-hub — card-widget