skills/pachca/openapi/pachca-files/Gen Agent Trust Hub

pachca-files

Pass

Audited by Gen Agent Trust Hub on Jun 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx -y @pachca/cli to download and execute the vendor's command-line interface directly from the npm registry. This is consistent with the skill's purpose for the Pachca service.
  • [COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands using npx, npm, and the pachca binary. These commands are used to manage authentication, check profile status, and interact with API endpoints.
  • [CREDENTIALS_UNSAFE]: The skill instructs the user to provide a PACHCA_TOKEN. It recommends passing this token via the --token flag or setting it in a local environment variable (export PACHCA_TOKEN=<token>). This follows standard practices for CLI authentication and does not involve hardcoded secrets.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 29, 2026, 01:59 PM
Security Audit — agent-trust-hub — pachca-files