release-peekaboo

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: Executes a local release script ./scripts/release-binaries.sh and uses tmux to manage sensitive session environment variables.\n- [COMMAND_EXECUTION]: Invokes platform-specific tools including xcrun notarytool and security to handle macOS app signing and notarization tasks.\n- [EXTERNAL_DOWNLOADS]: Uses npm exec to download and verify the newly published @steipete/peekaboo package directly from the public registry.\n- [DATA_EXPOSURE]: The skill writes the Apple Store Connect private key to a file in /tmp. While it sets permissions to 600 and deletes the file immediately after use, storing secrets in a world-writable directory is a security risk on multi-user systems.\n- [CREDENTIALS_SAFE]: Follows security best practices by utilizing 1Password (op) for secret handling and explicitly instructing the agent never to print or log sensitive materials like tokens, keys, or OTPs.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 05:23 AM
Security Audit — agent-trust-hub — release-peekaboo