wizard

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The template.sh file includes shell functions that interact with the system, such as open_url (which uses xdg-open, open, or explorer.exe), write_env (which modifies .env files using grep and mktemp), and set_secret (which uses the GitHub CLI gh). These are legitimate utility functions for the stated purpose of a setup wizard.
  • [CREDENTIALS_SAFE]: The skill explicitly instructs the AI to use ask_secret for sensitive data, ensuring that user input for credentials is not echoed to the terminal. It also encourages storing secrets in .env files or GitHub secrets via the gh tool, which is a standard and safe practice for secret management.
  • [SAFE]: The Stripe URL provided in the example stage is an official domain (dashboard.stripe.com), and the operations are localized to the user's environment and their own GitHub repository via official CLI tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 01:40 PM
Security Audit — agent-trust-hub — wizard