totp-generate

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [SAFE]: The skill instructions and bundled scripts adhere to high security standards, explicitly prohibiting the use of command-line arguments for secrets to prevent exposure via process monitoring tools and ensuring codes are handled as short-lived, single-use digits.
  • [COMMAND_EXECUTION]: The workflow documentation guides the user in using platform-native secure storage, such as the macOS Keychain (security utility) and Linux libsecret (secret-tool), ensuring secrets are retrieved dynamically rather than stored in plain text within the skill environment.
  • [EXTERNAL_DOWNLOADS]: The included totp.py script contains a utility for clock synchronization verification. This function performs a standard network HEAD request to Cloudflare's official domain to retrieve the HTTP Date header, which is used to diagnose local clock drift without transmitting sensitive data.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 11:52 AM
Security Audit — agent-trust-hub — totp-generate