release-peekaboo
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Executes a local release script
./scripts/release-binaries.shand usestmuxto manage sensitive session environment variables.\n- [COMMAND_EXECUTION]: Invokes platform-specific tools includingxcrun notarytoolandsecurityto handle macOS app signing and notarization tasks.\n- [EXTERNAL_DOWNLOADS]: Usesnpm execto download and verify the newly published@steipete/peekaboopackage directly from the public registry.\n- [DATA_EXPOSURE]: The skill writes the Apple Store Connect private key to a file in/tmp. While it sets permissions to600and deletes the file immediately after use, storing secrets in a world-writable directory is a security risk on multi-user systems.\n- [CREDENTIALS_SAFE]: Follows security best practices by utilizing 1Password (op) for secret handling and explicitly instructing the agent never to print or log sensitive materials like tokens, keys, or OTPs.
Audit Metadata