setting-up-devbox
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill employs hogli devbox:exec to run commands on remote devboxes and uses sudo tailscale for network routing. These operations are core to the skill's purpose of managing remote development workspaces.
- [CREDENTIALS_UNSAFE]: It provides instructions for managing environment variables and tokens (GitHub, Claude, AWS). The instructions prioritize safety by warning the agent never to echo these values or paste them into command lines.
- [EXTERNAL_DOWNLOADS]: The hogli devbox:setup process installs dependencies like the coder CLI and mutagen. These are reputable tools required for the Coder workspace functionality.
- [PROMPT_INJECTION]: The skill contains instructional guidance for the agent to ensure it uses the provided CLI tools correctly and maintains secret confidentiality, which serves as a safety guardrail rather than an injection attempt.
Audit Metadata