pachca-files
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y @pachca/clito download and execute the vendor's command-line interface directly from the npm registry. This is consistent with the skill's purpose for the Pachca service. - [COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands using
npx,npm, and thepachcabinary. These commands are used to manage authentication, check profile status, and interact with API endpoints. - [CREDENTIALS_UNSAFE]: The skill instructs the user to provide a
PACHCA_TOKEN. It recommends passing this token via the--tokenflag or setting it in a local environment variable (export PACHCA_TOKEN=<token>). This follows standard practices for CLI authentication and does not involve hardcoded secrets.
Audit Metadata