duoduo-runtime-admin
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to fetch updated subconscious partitions from the official vendor repository (https://github.com/openduo/duoduo.git). This is a legitimate maintenance function using a trusted vendor source.
- [DATA_EXPOSURE]: The skill manages sensitive configuration including API keys and model profiles. It incorporates explicit 'secret custody' rules, instructing the agent to never re-emit raw credentials, use secure file permissions (chmod 0600), and mask values in logs and confirmation messages.
- [COMMAND_EXECUTION]: The skill utilizes the duoduo CLI for daemon diagnostics, session management, and job lifecycle control. These are standard administrative operations within the intended scope of the tool.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data such as daemon logs and event records. It mitigates associated risks by establishing clear boundaries, such as requiring manual verification of diffs before overwriting local partition prompts with remote content.
Audit Metadata