totp-provider-api
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/fetch_code.pyscript executes theop(1Password) andbw(Bitwarden) command-line interfaces to retrieve TOTP codes. These executions use thesubprocess.runmethod with a list of arguments, which is a secure practice that avoids shell invocation and prevents command injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill performs network operations to reach HashiCorp Vault and 2FAuth API endpoints. These requests are made using the Python standard library's
urllib.requestmodule and are necessary for the skill's core functionality of retrieving codes from remote providers. The target URLs are configured by the user via environment variables or command-line arguments.
Audit Metadata