glove
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The documentation includes an example of a
bashtool for a coding agent. This is documented with a security-first approach, explicitly recommending the use of a permission-gating system (requiresPermission: true) to ensure user approval before execution. - [DATA_EXFILTRATION]: The framework implements a security feature where
renderData(client-only state) is explicitly stripped by model adapters before tool results are sent to the AI. This prevents sensitive UI state or private identifiers from being exposed to the LLM context. - [EXTERNAL_DOWNLOADS]: The skill references official installation commands for the Glove framework packages (
glove-core,glove-react,glove-next) and standard ecosystem dependencies likezod. These are hosted on the official NPM registry. - [SAFE]: The documentation provides robust architectural patterns for security, including schema validation for all tool inputs using Zod and a structured approach to session management and persistence.
Audit Metadata