software-factory

Pass

Audited by Gen Agent Trust Hub on Nov 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The helper script clones the official 'openhands/extensions' repository to retrieve automation catalog bundles. This resource is owned by the skill vendor and is required for the skill's primary function.
  • [COMMAND_EXECUTION]: Executes git commands via Python's subprocess module to manage local copies of configuration templates in a temporary directory. The use of subprocess is limited to fetching vendor-owned assets.
  • [SAFE]: Implements strict instructions to prevent the exposure of the GITHUB_PERSONAL_ACCESS_TOKEN, ensuring that the secret is only passed through environment variables and never logged or displayed in chat. The helper script reads the token from the environment and does not print it.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 7, 2026, 11:27 AM