double-loop
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill integrates development capabilities from external GitHub repositories. It enforces security through a manifest-based integrity system that validates the SHA-256 hash of each external component during installation.
- [COMMAND_EXECUTION]: The framework utilizes Git CLI commands for version control and state management within the project repository. It also runs local verification scripts using the system Python interpreter to validate the workspace setup.
- [DYNAMIC_EXECUTION]: Orchestration logic in the state management scripts uses dynamic module loading via 'importlib' to facilitate workflow transitions. These operations are confined to the skill's own local codebase.
- [SAFE]: The skill implements a 'safe_path' utility that strictly validates all file paths, preventing the use of parent directory references ('..') and blocking interaction with symlinks to mitigate traversal and escape vulnerabilities.
Audit Metadata