add-seed-skills
Warn
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to retrieve production environment variables using the 'vercel env pull' command and manually export the 'DATABASE_URL' secret.- [COMMAND_EXECUTION]: Executes shell commands to build local packages, validate markdown files, and run database seeding scripts ('pnpm', 'node', 'git').- [COMMAND_EXECUTION]: Relies on hardcoded absolute file paths (e.g., '/Users/promode/qaskills'), exposing the local environment's directory structure.- [COMMAND_EXECUTION]: Performs network operations via 'curl' to external API endpoints at 'qaskills.sh' to verify the state and content of the database.
Audit Metadata